CVE-2019-14847

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-06 · updated 2026-06-17
Weakness: CWE-476

Description

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.

Affected products

Fedoraproject Fedora: 29, 30
openSUSE Leap: 15.0
Samba: from 4.0.0 before 4.9.15; from 4.10.0 before 4.10.10 — fixed in 4.10.10, 4.9.15

How to fix

Upgrade to a fixed version: Samba 4.10.10, 4.9.15. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847
https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/
https://www.samba.org/samba/security/CVE-2019-14847.html
https://www.synology.com/security/advisory/Synology_SA_19_35
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847
https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html

Get alerted when CVE-2019-14847 or the next vulnerability affects your stack