CVE-2018-10918

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.

References

Affected packages

Git / github.com/samba-team/samba

Affected ranges

Type

GIT

Repo

https://github.com/samba-team/samba

Events

Introduced

d1e69845e28c20a491c4cd60c712b46ddfcb9dc0

Fixed

3e5da7e8878a78da96fbdccd05953c791560a6b5

Introduced

5a9d09fee44052e18ce241ec28f78498d2e20d73

Fixed

626c489c2c879aef8b82efe9f7e832cca0183f4d

Database specific

{
    "versions": [
        {
            "introduced": "4.7.0"
        },
        {
            "fixed": "4.7.9"
        },
        {
            "introduced": "4.8.0"
        },
        {
            "fixed": "4.8.4"
        }
    ]
}

Affected versions

ldb-1.*

ldb-1.2.3

ldb-1.3.3

ldb-1.3.4

ldb-1.3.5

samba-4.*

samba-4.7.0

samba-4.7.1

samba-4.7.2

samba-4.7.3

samba-4.7.4

samba-4.7.5

samba-4.7.6

samba-4.7.7

samba-4.7.8

samba-4.8.0

samba-4.8.1

samba-4.8.2

samba-4.8.3

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10918.json"