CVE-2015-7540: canonical ubuntu_linux Resource Management Errors
CVSS: 7.5v3.1HighModified
AliasesRHBA-2015:2258UBUNTU-CVE-2015-7540DEBIAN-CVE-2015-7540
Published 29-12-2015Last modified 06-08-2024
Vulnerability summary
CVE-2015-7540 is a high (CVSS 7.5) Resource Management Errors vulnerability in canonical ubuntu_linux. EPSS estimates a 7.12% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
7.12%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 29-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
7.12%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.12% on 20-09-2026
20-09-202620-10-2026
EPSS score7.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat28 products
- ctdb< 0:4.2.3-10.el7
- ctdb-devel< 0:4.2.3-10.el7
- ctdb-tests< 0:4.2.3-10.el7
- libsmbclient< 0:4.2.3-10.el7
- libsmbclient-devel< 0:4.2.3-10.el7
Debian2 products
- samba< 2:4.1.22+dfsg-1
- debian_linuxEOL7.0 | 8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Samba1 product
- samba≥ 4.0.0, < 4.1.22
Ubuntu1 product
- samba< 2:4.1.6+dfsg-1ubuntu2.14.04.11 | < 2:4.3.3+dfsg-1ubuntu1
5 vendors · 33 products
References
30 links- lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
Show all 30 references
- lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1288451X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
