The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users…

published 2014-06-23 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-3498

cvss: 2.7; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.3%; EPSS 7.3% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) via an attempt to read a Unicode pathname without specifying use of Unicode, leading to a character-set conversion failure that triggers an invalid pointer dereference.

Patch / fix

distros 4

debian ubuntu red hat opensuse

samba Debian 14, Debian 13, Debian 12 2:4.1.9+dfsg-1

debian advisories DEBIAN-CVE-2014-3493

samba Ubuntu 14.04 LTS 2:4.1.6+dfsg-1ubuntu2.14.04.2

ubuntu advisories UBUNTU-CVE-2014-3493

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

samba4 RHEL 6 4.0.0-63.el6_5.rc4
samba4-dc RHEL 6 4.0.0-63.el6_5.rc4
samba4-libs RHEL 6 4.0.0-63.el6_5.rc4
samba4-pidl RHEL 6 4.0.0-63.el6_5.rc4
samba4-swat RHEL 6 4.0.0-63.el6_5.rc4
samba4-test RHEL 6 4.0.0-63.el6_5.rc4
samba4-client RHEL 6 4.0.0-63.el6_5.rc4
samba4-common RHEL 6 4.0.0-63.el6_5.rc4

red hat advisories RHSA-2014:1009 RHSA-2014:0867 RHSA-2014:0866

samba openSUSE Tumbleweed 4.5.0-1.1

opensuse advisories openSUSE-SU-2024:10069-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3493 updated 2026-11-07 cvss 2.7

samba: smbd unicode path names denial of service

Red Hat Storage 2 samba
affected: no fix available
Red Hat Enterprise Linux (v. 5 server) samba3x 3.6.6-0.140.el5_10, samba3x-swat 3.6.6-0.140.el5_10, samba3x-client 3.6.6-0.140.el5_10, samba3x-common 3.6.6-0.140.el5_10, samba3x-winbind 3.6.6-0.140.el5_10, samba3x-domainjoin-gui 3.6.6-0.140.el5_10
fixed: vendor fix RHSA-2014:0866
Red Hat Enterprise Linux Client (v. 7) samba 4.1.1-35.el7_0, samba-libs 4.1.1-35.el7_0, libwbclient 4.1.1-35.el7_0, libsmbclient 4.1.1-35.el7_0, samba-client 4.1.1-35.el7_0, samba-common 4.1.1-35.el7_0, +2 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.1.1-35.el7_0, samba-dc 4.1.1-35.el7_0, samba-pidl 4.1.1-35.el7_0, samba-test 4.1.1-35.el7_0, samba-python 4.1.1-35.el7_0, samba-dc-libs 4.1.1-35.el7_0, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.1.1-35.el7_0, samba-libs 4.1.1-35.el7_0, libwbclient 4.1.1-35.el7_0, libsmbclient 4.1.1-35.el7_0, samba-client 4.1.1-35.el7_0, samba-common 4.1.1-35.el7_0, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.1.1-35.el7_0, samba-dc 4.1.1-35.el7_0, samba-pidl 4.1.1-35.el7_0, samba-test 4.1.1-35.el7_0, samba-python 4.1.1-35.el7_0, samba-dc-libs 4.1.1-35.el7_0, +3 more
fixed: vendor fix RHSA-2014:0867
Red Hat Enterprise Linux Desktop (v. 5 client) samba3x 3.6.6-0.140.el5_10, samba3x-swat 3.6.6-0.140.el5_10, samba3x-client 3.6.6-0.140.el5_10, samba3x-common 3.6.6-0.140.el5_10, samba3x-winbind 3.6.6-0.140.el5_10, samba3x-domainjoin-gui 3.6.6-0.140.el5_10 Red Hat Enterprise Linux Desktop (v. 6) samba 3.6.9-169.el6_5, samba4 4.0.0-63.el6_5.rc4, libsmbclient 3.6.9-169.el6_5, samba-client 3.6.9-169.el6_5, samba-common 3.6.9-169.el6_5, samba4-dc 4.0.0-63.el6_5.rc4, +13 more Red Hat Enterprise Linux Desktop Optional (v. 6) samba 3.6.9-169.el6_5, samba-swat 3.6.9-169.el6_5, samba-domainjoin-gui 3.6.9-169.el6_5, samba-winbind-krb5-locator 3.6.9-169.el6_5 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) samba3x 3.6.6-0.140.el5_10 Red Hat Enterprise Linux HPC Node (v. 6) samba 3.6.9-169.el6_5, samba4 4.0.0-63.el6_5.rc4, samba-client 3.6.9-169.el6_5, samba-common 3.6.9-169.el6_5, samba4-dc 4.0.0-63.el6_5.rc4, samba-winbind 3.6.9-169.el6_5, +12 more Red Hat Enterprise Linux HPC Node Optional (v. 6) samba 3.6.9-169.el6_5, samba-swat 3.6.9-169.el6_5, libsmbclient 3.6.9-169.el6_5, samba-domainjoin-gui 3.6.9-169.el6_5, samba-winbind-krb5-locator 3.6.9-169.el6_5

+1 more productsfewer

Red Hat Enterprise Linux Server (v. 6) samba 3.6.9-169.el6_5, samba4 4.0.0-63.el6_5.rc4, libsmbclient 3.6.9-169.el6_5, samba-client 3.6.9-169.el6_5, samba-common 3.6.9-169.el6_5, samba4-dc 4.0.0-63.el6_5.rc4, +13 more

fixed: vendor fix RHSA-2014:0866
Red Hat Enterprise Linux Server (v. 7) samba 4.1.1-35.el7_0, samba-libs 4.1.1-35.el7_0, libwbclient 4.1.1-35.el7_0, libsmbclient 4.1.1-35.el7_0, samba-client 4.1.1-35.el7_0, samba-common 4.1.1-35.el7_0, +3 more
fixed: vendor fix RHSA-2014:0867
Red Hat Enterprise Linux Server Optional (v. 6) samba 3.6.9-169.el6_5, samba-swat 3.6.9-169.el6_5, samba-domainjoin-gui 3.6.9-169.el6_5, samba-winbind-krb5-locator 3.6.9-169.el6_5
fixed: vendor fix RHSA-2014:0866
Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.1.1-35.el7_0, samba-pidl 4.1.1-35.el7_0, samba-test 4.1.1-35.el7_0, samba-python 4.1.1-35.el7_0, samba-dc-libs 4.1.1-35.el7_0, samba-vfs-glusterfs 4.1.1-35.el7_0, +2 more
fixed: vendor fix RHSA-2014:0867
Red Hat Enterprise Linux Workstation (v. 6) samba 3.6.9-169.el6_5, samba4 4.0.0-63.el6_5.rc4, libsmbclient 3.6.9-169.el6_5, samba-client 3.6.9-169.el6_5, samba-common 3.6.9-169.el6_5, samba4-dc 4.0.0-63.el6_5.rc4, +13 more
fixed: vendor fix RHSA-2014:0866

show 4 more

Red Hat Enterprise Linux Workstation (v. 7) samba 4.1.1-35.el7_0, samba-libs 4.1.1-35.el7_0, libwbclient 4.1.1-35.el7_0, libsmbclient 4.1.1-35.el7_0, samba-client 4.1.1-35.el7_0, samba-common 4.1.1-35.el7_0, +3 more
fixed: vendor fix RHSA-2014:0867
Red Hat Enterprise Linux Workstation Optional (v. 6) samba 3.6.9-169.el6_5, samba-swat 3.6.9-169.el6_5, samba-domainjoin-gui 3.6.9-169.el6_5, samba-winbind-krb5-locator 3.6.9-169.el6_5
fixed: vendor fix RHSA-2014:0866
Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.1.1-35.el7_0, samba-pidl 4.1.1-35.el7_0, samba-test 4.1.1-35.el7_0, samba-dc-libs 4.1.1-35.el7_0, samba-vfs-glusterfs 4.1.1-35.el7_0, samba-winbind-clients 4.1.1-35.el7_0, +1 more
fixed: vendor fix RHSA-2014:0867
Red Hat Enterprise Linux 5 samba
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.27% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	2.7	AV:A/AC:L/Au:S/C:N/I:N/A:P

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

mandriva.com /security/advisories?name=MDVSA-2014:136
vendor-advisory
rhn.redhat.com /errata/RHSA-2014-0866.html
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2014-August/136864.html
vendor-advisory
security.gentoo.org /glsa/glsa-201502-15.xml
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2014-June/134717.html
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2015:082
vendor-advisory
samba.org /samba/security/CVE-2014-3493
vendor-advisory
blogs.oracle.com /sunsecurity/entry/multiple_vulnerabilities_in_samba1
secunia.com /advisories/61218
third-party-advisory
secunia.com /advisories/59834
third-party-advisory
linux.oracle.com /errata/ELSA-2014-0866.html
secunia.com /advisories/59848
third-party-advisory
securityfocus.com /archive/1/532757/100/0/threaded
mailing-list
securityfocus.com /bid/68150
vdb-entry
secunia.com /advisories/59407
third-party-advisory
secunia.com /advisories/59433
third-party-advisory
secunia.com /advisories/59919
third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1108748
advisories.mageia.org /MGASA-2014-0279.html
secunia.com /advisories/59378
third-party-advisory
secunia.com /advisories/59579
third-party-advisory
h20566.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
securitytracker.com /id/1030455
vdb-entry

Sources

CVE List CVE-2014-3493
NVD CVE-2014-3493

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary