CVE-2015-7560: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 12.9% chance of exploitation in the next 30 days.

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Samba Samba: from 3.2.0, before 4.1.23 (fixed in 4.1.23); from 4.2.0, before 4.2.9 (fixed in 4.2.9); from 4.3.0, before 4.3.6 (fixed in 4.3.6); version 4.4.0 only

Published 2016-03-13. Last modified 2026-06-17.