CVE-2020-10700

A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

• CWE-416
• CWE-416

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WG54NRMES2GTURZKZH6H4BGXCD3OMJDJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/
• https://security.gentoo.org/glsa/202007-15Third Party Advisory
• https://www.samba.org/samba/security/CVE-2020-10700.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WG54NRMES2GTURZKZH6H4BGXCD3OMJDJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/
• https://security.gentoo.org/glsa/202007-15Third Party Advisory
• https://www.samba.org/samba/security/CVE-2020-10700.htmlVendor Advisory

Published

May 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10695An insecure modification flaw in the /etc/passwd file was fo…7.8
• CVE-2020-10696A path traversal flaw was found in Buildah in versions befor…8.8
• CVE-2020-10697A flaw was found in Ansible Tower when running Openshift. To…4.4
• CVE-2020-10698A flaw was found in Ansible Tower when running jobs. This fl…3.3
• CVE-2020-10699A flaw was found in Linux, in targetcli-fb versions 2.1.50 a…7.8
• CVE-2020-1070An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-10701A missing authorization flaw was found in the libvirt API re…6.5
• CVE-2020-10702A flaw was found in QEMU in the implementation of the Pointe…5.5
• CVE-2020-10703A NULL pointer dereference was found in the libvirt API resp…6.5
• CVE-2020-10704A flaw was found when using samba as an Active Directory Dom…7.5
• CVE-2020-10705A flaw was discovered in Undertow in versions before Underto…7.5
• CVE-2020-10706A flaw was found in OpenShift Container Platform where OAuth…6.6