CVE-2018-16852

    Dashboard / Vulnerabilities / CVE-2018-16852

    CVE-2018-16852

    Published: 28 Nov 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service.

    References: http://www.securityfocus.com/bid/106024, https://security.gentoo.org/glsa/202003-52, https://security.netapp.com/advisory/ntap-20181127-0001/, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16852, https://www.samba.org/samba/security/CVE-2018-16852.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4fc4ae2924aaa2fc184b7385069274526fa8a4c2
    Fixed -40c057c900a9367e8020c943d29547ea8942212f

    Affected versions

    samba-4.9.2
    samba-4.9.1
    samba-4.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High