samba -- multiple vulnerabilities

The Samba Team reports: CVE-2019-14861: An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name. CVE-2019-14870: The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests...

CVE-2019-14861: Incorrect Default Permissions

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the poorly named dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default...

CVE-2019-14870: Improper Authorization

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos...

CVE-2019-14870

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos...

Design/Logic Flaw

Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption. This affects the dce112clocksourcecreate function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the...

UBUNTU-CVE-2019-19083

Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption. This affects the dce112clocksourcecreate function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the...

CVE-2019-19083

Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption. This affects the dce112clocksourcecreate function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the...

CVE-2019-19083

Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption. This affects the dce112clocksourcecreate function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the...

CVE-2019-19082

Memory leaks in createresourcepool functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service memory consumption. This affects the dce120createresourcepool function in drivers/gpu/drm/amd/display/dc/dce120/dce120resource.c, the...

CVE-2019-19082

CVE-2019-19082 : Memory leaks in the Linux kernel’s AMD display driver DC code allow memory exhaustion/DoS via multiple create_resource_pool() variants (dce120/dce110/dce100/dcn10/dce112_resource.c; CID-104c307147ad). Affects kernel up to 5.3.11; exploitation would be local and relies on resource...

Linux kernel memory leak vulnerability (CNVD-2019-41274)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory leak vulnerability exists in the clocksourcecreate function under drivers/gpu/drm/amd/display/dc in Linux...

CVE-2019-19083: Missing Release of Memory after Effective Lifetime

Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption. This affects the dce112clocksourcecreate function in drivers/gpu/drm/amd/display/dc/dce112/dce112resource.c, the...

CVE-2019-19082: Missing Release of Memory after Effective Lifetime

Memory leaks in createresourcepool functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service memory consumption. This affects the dce120createresourcepool function in drivers/gpu/drm/amd/display/dc/dce120/dce120resource.c, the...

Identifying and Arresting Ransomware Criminals

The Wall Street Journal has a story about how two people were identified as the perpetrators of a ransomware scheme. They were found because -- as generally happens -- they made mistakes covering their tracks. They were investigated because they had the bad luck of locking up Washington, DC's vid...

Code injection

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...

openSUSE Security Update : samba (openSUSE-2019-2442)

This update for provides the following fixes : Following security issues were fixed : - CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync bsc1154598. - CVE-2019-10218: Client code could have returned filenames containing path separators bsc1144902...

CVE-2019-14847

CVE-2019-14847 affects Samba; versions 4.0.0 to before 4.9.15 and 4.10.x up to before 4.10.10 are vulnerable. An attacker can crash the AD DC LDAP server via dirsync, causing denial of service. Privilege escalation is not possible. Remediation: upgrade to Samba 4.9.15 or 4.10.10 (or later) as ind...

CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...

CVE-2019-14847: NULL Pointer Dereference

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...

CVE-2019-14847

A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue...