Medium severity5.4NVD Advisory· Published Apr 9, 2019· Updated Jun 17, 2026

CVE-2019-3880

Description

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

The Samba Project/sambav5
Range: 4.8.11
Samba (software)/Samballm-fuzzy2 versions
< 4.8.11, < 4.9.6, < 4.10.2+ 1 more
- (no CPE)range: < 4.8.11, < 4.9.6, < 4.10.2
- cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*range: >=3.2.0,<4.8.11
osv-coords55 versions
pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/samba&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/avahi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/avahi-glib2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/ldb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/talloc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/talloc-man&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/cups&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/cups&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/samba&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/samba-doc&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP4 pkg:rpm/suse/tevent-man&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/libtasn1&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP3 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP1 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/samba-doc&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/p11-kit&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP2 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/opensuse/ldb&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/samba&distro=openSUSE%20Tumbleweed pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/cups&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/gamin-devel&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/tevent&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/avahi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/avahi-glib2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/libtasn1&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/p11-kit&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/samba&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/tdb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/avahi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015
< 4.6.16+git.154.2998451b912-3.40.3+ 54 more
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 0.6.32-5.5.3
- (no CPE)range: < 0.6.32-5.5.8
- (no CPE)range: < 1.2.4-3.12.1
- (no CPE)range: < 2.1.11-3.5.3
- (no CPE)range: < 2.1.11-3.5.3
- (no CPE)range: < 2.2.7-3.11.7
- (no CPE)range: < 2.2.7-3.11.7
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 3.6.3-94.19.2
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 0.9.36-4.10.3
- (no CPE)range: < 3.6.2-6.5.4
- (no CPE)range: < 4.7.11+git.153.b36ceaf2235-4.27.1
- (no CPE)range: < 3.6.3-94.19.2
- (no CPE)range: < 4.13-4.2.1
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.7.11+git.153.b36ceaf2235-4.27.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 3.6.3-94.19.2
- (no CPE)range: < 0.23.2-4.2.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.4.2-38.25.1
- (no CPE)range: < 3.6.3-94.19.2
- (no CPE)range: < 1.2.4-lp150.10.1
- (no CPE)range: < 4.7.11+git.153.b36ceaf2235-lp150.3.14.1
- (no CPE)range: < 4.14.6+git.182.2205d5224e3-1.1
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 2.2.7-3.11.7
- (no CPE)range: < 0.1.10-3.2.3
- (no CPE)range: < 3.6.2-6.5.4
- (no CPE)range: < 3.4.1-4.9.1
- (no CPE)range: < 0.9.36-4.10.3
- (no CPE)range: < 0.6.32-5.5.3
- (no CPE)range: < 0.6.32-5.5.8
- (no CPE)range: < 3.4.1-4.9.1
- (no CPE)range: < 4.13-4.2.1
- (no CPE)range: < 0.23.2-4.2.1
- (no CPE)range: < 4.7.11+git.153.b36ceaf2235-4.27.1
- (no CPE)range: < 4.2.4-18.52.1
- (no CPE)range: < 4.2.4-18.52.1
- (no CPE)range: < 4.2.4-28.32.1
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 4.6.16+git.154.2998451b912-3.40.3
- (no CPE)range: < 1.3.15-3.6.3
- (no CPE)range: < 0.6.32-5.5.3
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Red Hat/Gluster Storage
cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.htmlnvdMailing ListPatchThird Party Advisory
www.samba.org/samba/security/CVE-2019-3880.htmlnvdMitigationPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.htmlnvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:1966nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:1967nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:2099nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3582nvdThird Party Advisory
access.redhat.com/security/cve/cve-2019-3880nvdMitigationThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingMitigationThird Party Advisory
lists.debian.org/debian-lts-announce/2019/04/msg00013.htmlnvdThird Party Advisory
security.netapp.com/advisory/ntap-20190411-0004/nvdThird Party Advisory
support.f5.com/csp/article/K20804356nvdThird Party Advisory
www.synology.com/security/advisory/Synology_SA_19_15nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRLRO7BPRFETVFZ4TVJL2VFZEPHKJY4/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000