Skip to content
Fencer Intel
high 7.5

CVE-2017-15275 in the critical feed json

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap…

published 8y ago modified 4mo ago also EUVD-2017-6735

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.4%
EPSS 21.4% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.

Patch / fix

  • samba samba 4.5.15, 4.6.11, 4.7.3
  • samba Debian 14, Debian 13, Debian 12 2:4.7.1+dfsg-2

debian advisories DEBIAN-CVE-2017-15275

  • samba Ubuntu 14.04 LTS 2:4.3.11+dfsg-0ubuntu0.14.04.13
  • samba Ubuntu 16.04 LTS 2:4.3.11+dfsg-0ubuntu0.16.04.12

ubuntu advisories UBUNTU-CVE-2017-15275

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba4 RHEL 6 4.2.10-12.el6_9
  • samba4-dc RHEL 6 4.2.10-12.el6_9
  • samba4-libs RHEL 6 4.2.10-12.el6_9
  • samba4-pidl RHEL 6 4.2.10-12.el6_9
  • samba4-test RHEL 6 4.2.10-12.el6_9
  • samba4-client RHEL 6 4.2.10-12.el6_9
  • samba4-common RHEL 6 4.2.10-12.el6_9
  • samba4-python RHEL 6 4.2.10-12.el6_9

red hat advisories RHSA-2017:3278RHSA-2017:3260RHSA-2017:3261

  • samba SLES 12-LTSS, SLE High Availability Extension 12 4.2.4-18.49.1
  • samba SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 3.6.3-94.8.1
  • samba SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +3 more 4.6.9+git.59.c2cff9cea4c-3.17.1
  • samba SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +3 more 4.4.2-38.14.1
  • samba SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +6 more 4.2.4-28.24.1

suse advisories SUSE-SU-2018:2321-1SUSE-SU-2018:0018-1SUSE-SU-2017:3155-1SUSE-SU-2017:3104-1SUSE-SU-2017:3086-1

  • samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1

opensuse advisories openSUSE-SU-2024:11365-1

  • samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 4.7.3-r0
  • samba Alpine 3.4 4.4.16-r1

alpine advisories ALPINE-CVE-2017-15275

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba Azure Linux 3.0 4.18.3-1

azure linux advisories AZL-44070

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • samba Arch Linux 4.7.3-1

arch linux advisories AVG-535

Is CVE-2017-15275 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-15275 updated cvss 4.3

samba: Server heap-memory disclosure

  • Red Hat Enterprise Linux 5 samba Red Hat Enterprise Linux 6 samba, samba-swat, libsmbclient, samba-client, samba-common, samba-winbind, +4 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) samba 4.6.2-12.el7_4, samba-libs 4.6.2-12.el7_4, libwbclient 4.6.2-12.el7_4, libsmbclient 4.6.2-12.el7_4, samba-client 4.6.2-12.el7_4, samba-common 4.6.2-12.el7_4, +7 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.6.2-12.el7_4, samba-dc 4.6.2-12.el7_4, samba-pidl 4.6.2-12.el7_4, samba-test 4.6.2-12.el7_4, samba-python 4.6.2-12.el7_4, samba-dc-libs 4.6.2-12.el7_4, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.6.2-12.el7_4, samba-libs 4.6.2-12.el7_4, libwbclient 4.6.2-12.el7_4, libsmbclient 4.6.2-12.el7_4, samba-client 4.6.2-12.el7_4, samba-common 4.6.2-12.el7_4, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.6.2-12.el7_4, samba-dc 4.6.2-12.el7_4, samba-pidl 4.6.2-12.el7_4, samba-test 4.6.2-12.el7_4, samba-python 4.6.2-12.el7_4, samba-dc-libs 4.6.2-12.el7_4, +4 more
    fixed: vendor fix RHSA-2017:3260
  • Red Hat Enterprise Linux Desktop (v. 6) samba4 4.2.10-12.el6_9, samba4-dc 4.2.10-12.el6_9, samba4-libs 4.2.10-12.el6_9, samba4-pidl 4.2.10-12.el6_9, samba4-test 4.2.10-12.el6_9, samba4-client 4.2.10-12.el6_9, +6 more
    fixed: vendor fix RHSA-2017:3278
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) samba 4.6.2-12.el7_4, samba-libs 4.6.2-12.el7_4, libwbclient 4.6.2-12.el7_4, libsmbclient 4.6.2-12.el7_4, samba-client 4.6.2-12.el7_4, samba-common 4.6.2-12.el7_4, +8 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) samba-dc 4.6.2-12.el7_4, samba-pidl 4.6.2-12.el7_4, samba-test 4.6.2-12.el7_4, samba-python 4.6.2-12.el7_4, samba-dc-libs 4.6.2-12.el7_4, samba-test-libs 4.6.2-12.el7_4, +1 more
    fixed: vendor fix RHSA-2017:3260
  • Red Hat Enterprise Linux HPC Node (v. 6) samba4 4.2.10-12.el6_9, samba4-dc 4.2.10-12.el6_9, samba4-libs 4.2.10-12.el6_9, samba4-pidl 4.2.10-12.el6_9, samba4-test 4.2.10-12.el6_9, samba4-client 4.2.10-12.el6_9, +6 more Red Hat Enterprise Linux Server (v. 6) samba4 4.2.10-12.el6_9, samba4-dc 4.2.10-12.el6_9, samba4-libs 4.2.10-12.el6_9, samba4-pidl 4.2.10-12.el6_9, samba4-test 4.2.10-12.el6_9, samba4-client 4.2.10-12.el6_9, +6 more
    fixed: vendor fix RHSA-2017:3278
  • Red Hat Enterprise Linux Server (v. 7) samba 4.6.2-12.el7_4, samba-libs 4.6.2-12.el7_4, libwbclient 4.6.2-12.el7_4, libsmbclient 4.6.2-12.el7_4, samba-client 4.6.2-12.el7_4, samba-common 4.6.2-12.el7_4, +8 more Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.6.2-12.el7_4, samba-pidl 4.6.2-12.el7_4, samba-test 4.6.2-12.el7_4, samba-python 4.6.2-12.el7_4, samba-dc-libs 4.6.2-12.el7_4, samba-test-libs 4.6.2-12.el7_4, +2 more Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.6.2-12.el7_4, ctdb-tests 4.6.2-12.el7_4
    fixed: vendor fix RHSA-2017:3260
  • Red Hat Enterprise Linux Workstation (v. 6) samba4 4.2.10-12.el6_9, samba4-dc 4.2.10-12.el6_9, samba4-libs 4.2.10-12.el6_9, samba4-pidl 4.2.10-12.el6_9, samba4-test 4.2.10-12.el6_9, samba4-client 4.2.10-12.el6_9, +6 more
    fixed: vendor fix RHSA-2017:3278
  • Red Hat Enterprise Linux Workstation (v. 7) samba 4.6.2-12.el7_4, samba-libs 4.6.2-12.el7_4, libwbclient 4.6.2-12.el7_4, libsmbclient 4.6.2-12.el7_4, samba-client 4.6.2-12.el7_4, samba-common 4.6.2-12.el7_4, +8 more Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.6.2-12.el7_4, samba-pidl 4.6.2-12.el7_4, samba-test 4.6.2-12.el7_4, samba-dc-libs 4.6.2-12.el7_4, samba-test-libs 4.6.2-12.el7_4, samba-vfs-glusterfs 4.6.2-12.el7_4, +1 more
    fixed: vendor fix RHSA-2017:3260
show 1 more
  • Red Hat Gluster 3.3 Samba on RHEL-6 ctdb 4.6.3-9.el6rhs, samba 4.6.3-9.el6rhs, samba-dc 4.6.3-9.el6rhs, ctdb-tests 4.6.3-9.el6rhs, samba-libs 4.6.3-9.el6rhs, samba-pidl 4.6.3-9.el6rhs, +17 more Red Hat Gluster 3.3 Samba on RHEL-7 ctdb 4.6.3-9.el7rhgs, samba 4.6.3-9.el7rhgs, samba-dc 4.6.3-9.el7rhgs, ctdb-tests 4.6.3-9.el7rhgs, samba-libs 4.6.3-9.el7rhgs, samba-pidl 4.6.3-9.el7rhgs, +17 more
    fixed: vendor fix RHSA-2017:3261

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

21.41% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.