4.3
Medium
CVE-2022-3437 A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3()…
Description
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
Affected products and versions
References
- bugzilla.redhat.com bugzilla.redhat.com
- www.samba.org www.samba.org
- access.redhat.com access.redhat.com
- [oss-security] 20230208 [vs] heimdal: CVE-2022-45142: signature validation failure www.openwall.com
- security.netapp.com security.netapp.com
- GLSA-202309-06 security.gentoo.org
- GLSA-202310-06 security.gentoo.org
- [debian-lts-announce] 20240422 [SECURITY] [DLA 3792-1] samba security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of samba
The 40 CVEs of samba →
CVE-2023-4154
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active…
7.5
High
CVE-2023-0614
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was…
7.7
High
CVE-2023-0922
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset…
5.9
Medium
CVE-2023-0225
A flaw was found in Samba
4.3
Medium