CLSA-2026-1786477676 Fix CVE(s): CVE-2026-6949

SECURITY UPDATE: out-of-bounds write in the internal DNS server via a TSIG-signed packet using DNS name compression - debian/patches/CVE-2026-6949.patch: record the start offset of each dnsresrec while pulling it and use the last additional record's offset to truncate the buffer for TSIG...

CLSA-2026-1786093517 samba: Fix of CVE-2026-6949

CVE-2026-6949: correctly truncate the buffer used for DNS TSIG verification so a crafted TSIG record with name compression cannot underflow the packet length and trigger an out-of-bounds write in the AD DC internal DNS server...

CVE-2026-58218

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the...

CVE-2026-58218: Insufficient Resource Pool

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the...

CVE-2026-58218: Insufficient Resource Pool

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the...

openSUSE: Security Advisory for samba (openSUSE-SU-2016:0813-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-0771

The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service out-of-bounds read or possibly obtain sensitive information from process memory by...

CVE-2016-0771: Improper Restriction of Operations within the Bounds of a Memory Buffer

The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service out-of-bounds read or possibly obtain sensitive information from process memory by...

PT-2016-1599

Name of the Vulnerable Software and Affected Versions Samba versions 4.1.x through 4.1.22 Samba versions 4.2.x through 4.2.8 Samba versions 4.3.x through 4.3.5 Samba versions 4.4.x through 4.4.0rc3 Description The internal DNS server in Samba, when an AD DC is configured, allows remote...

[slackware-security] samba (SSA:2014-175-04)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security samba SSA:2014-175-04 New samba packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+...

CVE-2014-0239

The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service CPU and bandwidth consumption via a forged response packet that triggers a...

CVE-2014-0239: Improper Input Validation

The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service CPU and bandwidth consumption via a forged response packet that triggers a...

PT-2014-1431

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.0.18 Description The internal DNS server in Samba does not check the QR field in the header section of an incoming DNS message before sending a response. This allows remote attackers to cause a denial of service CPU a...