UnratedFix available
samba — security advisory
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
- Products
- samba
- Affected versions
- Not specified
- Fixed versions
- 2:3.3.6-1
- CVEs
- CVE-2009-1888
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:01 UTC · Revision 1
Source evidence
The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.
osv:DEBIAN-CVE-2009-1888
samba
Fixed versions: 2:3.3.6-1
samba
Fixed versions: 2:3.3.6-1
samba
Fixed versions: 2:3.3.6-1
Complete source record
{
"id": "bf3fbb886f27ce930f0cc8c31d9570180f119dd32fb8c00f7bda44886e8af527",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2009-1888",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2009-1888",
"summary": "The acl_group_override function in smbd/posix_acls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.",
"evidence": "osv:DEBIAN-CVE-2009-1888",
"products": [
{
"name": {
"value": "samba",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:3.3.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "samba",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:3.3.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "samba",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:3.3.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2009-1888",
"aliases": [
"DEBIAN-CVE-2009-1888"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:3.3.6-1"
}
]
}
],
"package": {
"name": "samba",
"purl": "pkg:deb/debian/samba?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1888.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:3.3.6-1"
}
]
}
],
"package": {
"name": "samba",
"purl": "pkg:deb/debian/samba?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1888.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:3.3.6-1"
}
]
}
],
"package": {
"name": "samba",
"purl": "pkg:deb/debian/samba?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1888.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T17:47:32.711287556Z",
"provider": "osv",
"upstream": [
"CVE-2009-1888"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2009-1888"
]
},
"related_cves": [
{
"value": "CVE-2009-1888",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417534,
"published_at": "2009-06-25T01:30:01.75+00:00"
}