Buffer overflow on SMB/CIFS packet re-assembly, chown race conditions.
vulners.com/securityvulns/securityvulns:doc:4217
vulners.com/securityvulns/securityvulns:doc:4272
vulners.com/securityvulns/securityvulns:doc:4363