CVE-2019-19344

Published: Jan 21, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

Affected (12)

Products: Samba: Samba · Canonical: Ubuntu Linux · Synology: Directory Server, Diskstation Manager, Router Manager, Skynas · +1 more

Show all products

Samba: Samba · Canonical: Ubuntu Linux · Synology: Directory Server, Diskstation Manager, Router Manager, Skynas · Opensuse: Leap

1 product

1 product

4 products

Directory Server

Diskstation Manager

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	From 4.10.0 to 4.10.12
Samba Samba	From 4.11.0 to 4.11.5
Samba Samba	From 4.9.0 to 4.9.18

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 19.10

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Synology Directory Server	All versions
Synology Diskstation Manager	Version 6.2
Synology Router Manager	Version 1.2
Synology Skynas	All versions

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (20)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19344

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202003-52

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20200122-0001/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/4244-1/

Source: secalert@redhat.com

Third Party Advisory

https://www.samba.org/samba/security/CVE-2019-19344.html

Source: secalert@redhat.com

Vendor Advisory

https://www.synology.com/security/advisory/Synology_SA_20_01

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19344

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202003-52

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20200122-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4244-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.samba.org/samba/security/CVE-2019-19344.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.synology.com/security/advisory/Synology_SA_20_01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.