Memory leak in Samba - CVE-2017-15275

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9373

Memory leak in Samba - CVE-2017-15275

Published: November 21, 2017


Vulnerability identifier: #VU9373
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15275
CWE-ID: CWE-401
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to access potentially sensitive information.

The vulnerability exists due to uncleared heap memory is sent to the client. A remote attacker can obtain potentially sensitive information and use it in further attacks.


Affected software

Samba
Debian Linux
Arch Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Slackware Linux
Fedora
Red Hat Gluster Storage Server for On-premise
samba (Alpine package)
samba
RoboHelp

How to mitigate CVE-2017-15275

Update to version 4.5.15, 4.6.11 or 4.7.3.

samba (Alpine package) - update to 4.4.16-r1
samba - addressed in versions 4.6.11-0.fc26, 4.7.3-0.fc27

External References

Related Security Bulletins