CVE-2015-5252 in the critical feed json
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relat…
published 2015-12-29 10 y ago modified 2026-06-17 4 mo ago also EUVD-2015-5242
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.3%
- EPSS 13.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Patch / fix
- samba samba 4.1.22, 4.2.7, 4.3.3
- samba Debian 14, Debian 13, Debian 12 2:4.1.22+dfsg-1
debian advisories DEBIAN-CVE-2015-5252
- samba Ubuntu 14.04 LTS 2:4.1.6+dfsg-1ubuntu2.14.04.11
- samba Ubuntu 16.04 LTS 2:4.3.3+dfsg-1ubuntu1
ubuntu advisories UBUNTU-CVE-2015-5252
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba RHEL 7 4.2.3-11.el7_2
- ctdb RHEL 7 4.2.3-11.el7_2
- samba-dc RHEL 7 4.2.3-11.el7_2
- ctdb-tests RHEL 7 4.2.3-11.el7_2
- samba-libs RHEL 7 4.2.3-11.el7_2
- samba-pidl RHEL 7 4.2.3-11.el7_2
- samba-test RHEL 7 4.2.3-11.el7_2
- libwbclient RHEL 7 4.2.3-11.el7_2
red hat advisories RHSA-2016:0006RHSA-2016:0016RHSA-2016:0015RHSA-2016:0010RHSA-2016:0011
- samba SLES for SAP 11 SP4, SLES for SAP 11 SP3, SLES 11 SP4 +6 more 3.6.3-64.1
- tevent SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 0.9.26-4.1
- ldb SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 1.1.24-4.1
- tdb SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 1.3.8-4.1
- samba SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 4.2.4-6.1
- talloc SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 2.1.5-4.1
- tevent SLES for SAP 12, SLES 12, SLED 12 +1 more 0.9.26-3.3.1
- ldb SLES for SAP 12, SLES 12, SLED 12 +1 more 1.1.24-4.3.1
suse advisories SUSE-SU-2016:0164-1SUSE-SU-2016:0032-1SUSE-SU-2015:2305-1SUSE-SU-2015:2304-1
- samba openSUSE Tumbleweed 4.5.0-1.1
opensuse advisories openSUSE-SU-2024:10069-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-5252 updated cvss 4.3
samba: Insufficient symlink verification in smbd
-
Red Hat Enterprise Linux 5 samba, samba3xaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) samba 4.2.3-11.el7_2, samba-libs 4.2.3-11.el7_2, libwbclient 4.2.3-11.el7_2, libsmbclient 4.2.3-11.el7_2, samba-client 4.2.3-11.el7_2, samba-common 4.2.3-11.el7_2, +6 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.2.3-11.el7_2, samba-dc 4.2.3-11.el7_2, samba-pidl 4.2.3-11.el7_2, samba-test 4.2.3-11.el7_2, samba-python 4.2.3-11.el7_2, samba-dc-libs 4.2.3-11.el7_2, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.2.3-11.el7_2, samba-libs 4.2.3-11.el7_2, libwbclient 4.2.3-11.el7_2, libsmbclient 4.2.3-11.el7_2, samba-client 4.2.3-11.el7_2, samba-common 4.2.3-11.el7_2, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.2.3-11.el7_2, samba-dc 4.2.3-11.el7_2, samba-pidl 4.2.3-11.el7_2, samba-test 4.2.3-11.el7_2, samba-python 4.2.3-11.el7_2, samba-dc-libs 4.2.3-11.el7_2, +3 morefixed: vendor fix RHSA-2016:0006
-
Red Hat Enterprise Linux Desktop (v. 6) samba 3.6.23-24.el6_7, samba4 4.0.0-67.el6_7.rc4, libsmbclient 3.6.23-24.el6_7, samba-client 3.6.23-24.el6_7, samba-common 3.6.23-24.el6_7, samba4-dc 4.0.0-67.el6_7.rc4, +13 more Red Hat Enterprise Linux Desktop Optional (v. 6) samba 3.6.23-24.el6_7, samba-swat 3.6.23-24.el6_7, samba-glusterfs 3.6.23-24.el6_7, samba-domainjoin-gui 3.6.23-24.el6_7, samba-winbind-krb5-locator 3.6.23-24.el6_7 Red Hat Enterprise Linux HPC Node (v. 6) samba 3.6.23-24.el6_7, samba4 4.0.0-67.el6_7.rc4, samba-client 3.6.23-24.el6_7, samba-common 3.6.23-24.el6_7, samba4-dc 4.0.0-67.el6_7.rc4, samba-winbind 3.6.23-24.el6_7, +12 more Red Hat Enterprise Linux HPC Node Optional (v. 6) samba 3.6.23-24.el6_7, samba-swat 3.6.23-24.el6_7, libsmbclient 3.6.23-24.el6_7, samba-glusterfs 3.6.23-24.el6_7, samba-domainjoin-gui 3.6.23-24.el6_7, samba-winbind-krb5-locator 3.6.23-24.el6_7 Red Hat Enterprise Linux Server (v. 6) samba 3.6.23-24.el6_7, samba4 4.0.0-67.el6_7.rc4, libsmbclient 3.6.23-24.el6_7, samba-client 3.6.23-24.el6_7, samba-common 3.6.23-24.el6_7, samba4-dc 4.0.0-67.el6_7.rc4, +13 morefixed: vendor fix RHSA-2016:0011
-
Red Hat Enterprise Linux Server (v. 7) samba 4.2.3-11.el7_2, samba-libs 4.2.3-11.el7_2, libwbclient 4.2.3-11.el7_2, libsmbclient 4.2.3-11.el7_2, samba-client 4.2.3-11.el7_2, samba-common 4.2.3-11.el7_2, +7 morefixed: vendor fix RHSA-2016:0006
-
Red Hat Enterprise Linux Server Optional (v. 6) samba-swat 3.6.23-24.el6_7, samba-glusterfs 3.6.23-24.el6_7, samba-domainjoin-gui 3.6.23-24.el6_7, samba-winbind-krb5-locator 3.6.23-24.el6_7fixed: vendor fix RHSA-2016:0011
-
Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.2.3-11.el7_2, samba-pidl 4.2.3-11.el7_2, samba-test 4.2.3-11.el7_2, samba-python 4.2.3-11.el7_2, samba-dc-libs 4.2.3-11.el7_2, samba-test-libs 4.2.3-11.el7_2, +2 more Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.2.3-11.el7_2, ctdb-tests 4.2.3-11.el7_2fixed: vendor fix RHSA-2016:0006
-
Red Hat Enterprise Linux Workstation (v. 6) samba 3.6.23-24.el6_7, samba4 4.0.0-67.el6_7.rc4, libsmbclient 3.6.23-24.el6_7, samba-client 3.6.23-24.el6_7, samba-common 3.6.23-24.el6_7, samba4-dc 4.0.0-67.el6_7.rc4, +13 morefixed: vendor fix RHSA-2016:0011
-
Red Hat Enterprise Linux Workstation (v. 7) samba 4.2.3-11.el7_2, samba-libs 4.2.3-11.el7_2, libwbclient 4.2.3-11.el7_2, libsmbclient 4.2.3-11.el7_2, samba-client 4.2.3-11.el7_2, samba-common 4.2.3-11.el7_2, +7 morefixed: vendor fix RHSA-2016:0006
show 4 moreshow fewer
-
Red Hat Enterprise Linux Workstation Optional (v. 6) samba-swat 3.6.23-24.el6_7, samba-glusterfs 3.6.23-24.el6_7, samba-domainjoin-gui 3.6.23-24.el6_7, samba-winbind-krb5-locator 3.6.23-24.el6_7fixed: vendor fix RHSA-2016:0011
-
Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.2.3-11.el7_2, samba-pidl 4.2.3-11.el7_2, samba-test 4.2.3-11.el7_2, samba-dc-libs 4.2.3-11.el7_2, samba-test-libs 4.2.3-11.el7_2, samba-vfs-glusterfs 4.2.3-11.el7_2, +1 morefixed: vendor fix RHSA-2016:0006
-
Red Hat Gluster 3 Samba on RHEL-6 samba 4.1.17-16.el6rhs, samba-dc 4.1.17-16.el6rhs, samba-libs 4.1.17-16.el6rhs, samba-pidl 4.1.17-16.el6rhs, samba-test 4.1.17-16.el6rhs, libwbclient 4.1.17-16.el6rhs, +11 morefixed: vendor fix RHSA-2016:0015
-
Red Hat Gluster 3 Samba on RHEL-7 ctdb 4.2.4-9.1.el7rhgs, samba 4.2.4-9.1.el7rhgs, samba-dc 4.2.4-9.1.el7rhgs, ctdb-tests 4.2.4-9.1.el7rhgs, samba-libs 4.2.4-9.1.el7rhgs, samba-pidl 4.2.4-9.1.el7rhgs, +16 morefixed: vendor fix RHSA-2016:0016
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
13.27% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- samba.org https://www.samba.org/samba/security/CVE-2015-5252.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
samba.org
/samba/security/CVE-2015-5252.html
exploit, vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2015-December/174391.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00042.html
vendor-advisory, mailing-list, third-party-advisory
-
ubuntu.com
/usn/USN-2855-2
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-01/msg00002.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-12/msg00019.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-12/msg00020.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-01/msg00017.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-12/msg00032.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00046.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2015-December/174076.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00047.html
vendor-advisory, mailing-list, third-party-advisory
-
debian.org
/security/2016/dsa-3433
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00048.html
vendor-advisory, mailing-list, third-party-advisory
-
security.gentoo.org
/glsa/201612-47
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-2855-1
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-12/msg00033.html
vendor-advisory, mailing-list, third-party-advisory
-
securityfocus.com
/bid/79733
vdb-entry, third-party-advisory
-
oracle.com
/technetwork/topics/security/linuxbulletinjan2016-2867209.html
third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=1290288
issue-tracking, third-party-advisory
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993
third-party-advisory
- git.samba.org /?p=samba.git%3Ba=commit%3Bh=4278ef25f64d5fdbf432ff1534e275416ec9561e
-
securitytracker.com
/id/1034493
vdb-entry, third-party-advisory
-
oracle.com
/technetwork/topics/security/bulletinjan2016-2867206.html
third-party-advisory
Sources
- CVE List CVE-2015-5252
- NVD CVE-2015-5252
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.