Description
NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.1.11+dfsg-1 | — |
| Debian 13 | samba | 2:4.1.11+dfsg-1 | — |
| Debian 12 | samba | 2:4.1.11+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | samba | 2:4.1.6+dfsg-1ubuntu2.14.04.3 | USN-2305-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | samba +19 | 4.1.1-37.el7_0 | RHSA-2014:1008 |
| RHEL 6 | samba4 +13 | 4.0.0-63.el6_5.rc4 | RHSA-2014:1009 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.5.0-1.1 | openSUSE-SU-2024:10069-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | samba +19 | 4.1.1-37.el7_0 | ELSA-2014-1008 |
Advisories 5
- RHSA-2014:1008 Red Hat Security Advisory: samba security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:1009 Red Hat Security Advisory: samba4 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-2305-1 samba vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10069-1 ctdb-4.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-1008 Important: samba security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 5, 2014
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1126010
- http://www.samba.org/samba/security/CVE-2014-3560
- FEDORA-2014-9141 vendor-advisory
- FEDORA-2014-9132 vendor-advisory
- https://git.samba.org/?p=samba.git%3Ba=commitdiff%3Bh=e6a848630da3ba958c442438ea131c99fa088605
- 1030663 vdb-entry
- 59583 third-party-advisory
- 69021 vdb-entry
- USN-2305-1 vendor-advisory
- openSUSE-SU-2014:1040 vendor-advisory
- https://git.samba.org/?p=samba.git%3Ba=commitdiff%3Bh=fb1d325d96dfe9bc2e9c4ec46ad4c55e8f18f4a2
- 59610 third-party-advisory
- samba-cve20143560-bo(95081) vdb-entry
- 59976 third-party-advisory