SUSE SLES12 Security Update : samba (SUSE-SU-2019:2893-1)

This update for samba fixes the following issue : CVE-2019-10218: Fixed a path injection caused by filenames containing path separators bso14071 bsc1144902. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

CVE-2019-10218

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this...

CVE-2019-14833

CVE-2019-14833 affects Samba, specifically the AD DC password handling where a custom script for password complexity may fail to verify non‑ASCII passwords, potentially allowing weak passwords and dictionary attacks. Affected releases include Samba 4.5.0 up to but not including 4.9.15, and also 4...

CVE-2019-14847

CVE-2019-14847 affects Samba; versions 4.0.0 to before 4.9.15 and 4.10.x up to before 4.10.10 are vulnerable. An attacker can crash the AD DC LDAP server via dirsync, causing denial of service. Privilege escalation is not possible. Remediation: upgrade to Samba 4.9.15 or 4.10.10 (or later) as ind...

CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...

CVE-2019-14833

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for passwo...

CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...

samba: save registry file outside share as unprivileged user

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share...

Moderate: Red Hat Security Advisory: samba security, bug fix, and enhancement update

An update for samba is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

OPENSUSE-SU-2019:2442-1 Security update for samba

This update for provides the following fixes: Following security issues were fixed: - CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync bsc1154598. - CVE-2019-10218: Client code could have returned filenames containing path separators bsc1144902. ...

SUSE-SU-2019:2893-1 Security update for samba

This update for samba fixes the following issue: - CVE-2019-10218: Fixed a path injection caused by filenames containing path separators bso14071 bsc1144902...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2019:2890-1)

This update for samba fixes the following issues : CVE-2019-10218: Client code can return filenames containing path separators bsc1144902. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Security fix for the ALT Linux 8 package samba version 4.9.15-alt1

4.9.15-alt1 built Nov. 5, 2019 Evgeny Sinelnikov in task 239962 Oct. 29, 2019 Evgeny Sinelnikov - Update to second security autumn release - Security fixes: + CVE-2019-10218 Client code can return filenames containing path separators + CVE-2019-14833 Samba AD DC check password script does not...

Security fix for the ALT Linux 8 package samba-DC version 4.9.15-alt1

4.9.15-alt1 built Nov. 5, 2019 Evgeny Sinelnikov in task 239962 Oct. 29, 2019 Evgeny Sinelnikov - Update to second security autumn release - Security fixes: + CVE-2019-10218 Client code can return filenames containing path separators + CVE-2019-14833 Samba AD DC check password script does not...

Security update for samba (important)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2019:2442-1 Rating: important References: 1144902 1148539 1152143 1154289 1154598 Cross-References: CVE-2019-10218 CVE-2019-14833 CVE-2019-14847 Affected Products: openSUSE Leap 15.1 An update that solves three...

SUSE-SU-2019:2890-1 Security update for samba

This update for samba fixes the following issues: - CVE-2019-10218: Client code can return filenames containing path separators bsc1144902...

Medium: samba

Issue Overview: A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba...

[ASA-201911-6] samba: multiple issues

Arch Linux Security Advisory ASA-201911-6 ========================================= Severity: Medium Date : 2019-11-03 CVE-ID : CVE-2019-10218 CVE-2019-14833 CVE-2019-14847 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1057 Summary ======= The packa...

SUSE SLES12 Security Update : samba (SUSE-SU-2019:2875-1)

This update for samba fixes the following issues : CVE-2019-10218: Fixed a path injection caused by filenames containing path separators bso14071 bsc1144902. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

FreeBSD : samba -- multiple vulnerabilities (50a1bbc9-fb80-11e9-9e70-005056a311d1)

The samba project reports : Malicious servers can cause Samba client code to return filenames containing path separators to calling code. When the password contains multi-byte non-ASCII characters, the check password script does not receive the full password string. Users with the 'get changes'...