CVE-2017-2619

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.

• CWE-362
• CWE-59
• CWE-362

• http://www.securityfocus.com/bid/97033Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038117Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1265Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2338Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2778Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2789Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1429472Issue Tracking, Third Party Advisory
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_usThird Party Advisory
• https://www.debian.org/security/2017/dsa-3816Third Party Advisory
• https://www.exploit-db.com/exploits/41740/Exploit, Third Party Advisory, VDB Entry
• https://www.samba.org/samba/security/CVE-2017-2619.htmlVendor Advisory
• http://www.securityfocus.com/bid/97033Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038117Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1265Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2338Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2778Third Party Advisory
• https://access.redhat.com/errata/RHSA-2017:2789Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1429472Issue Tracking, Third Party Advisory
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_usThird Party Advisory
• https://www.debian.org/security/2017/dsa-3816Third Party Advisory
• https://www.exploit-db.com/exploits/41740/Exploit, Third Party Advisory, VDB Entry
• https://www.samba.org/samba/security/CVE-2017-2619.htmlVendor Advisory

Published

Mar 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-2613jenkins before versions 2.44, 2.32.2 is vulnerable to a user…5.4
• CVE-2017-2614When updating a password in the rhvm database the ovirt-aaa-…6.8
• CVE-2017-2615Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA em…5.5
• CVE-2017-2616A race condition was found in util-linux before 2.32.1 in th…5.5
• CVE-2017-2617hawtio before version 1.5.5 is vulnerable to remote code exe…7.6
• CVE-2017-2618A flaw was found in the Linux kernel's handling of clearing …5.5
• CVE-2017-2620Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD …5.5
• CVE-2017-2621An access-control flaw was found in the OpenStack Orchestrat…5.5
• CVE-2017-2622An accessibility flaw was found in the OpenStack Workflow (m…5.9
• CVE-2017-2623It was discovered that rpm-ostree and rpm-ostree-client befo…5.3
• CVE-2017-2624It was found that xorg-x11-server before 1.19.0 including us…5.9
• CVE-2017-2625It was discovered that libXdmcp before 1.1.2 including used …6.5