[slackware-security] samba

New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/samba-4.6.16-i586-2slack14.2.txz: Rebuilt. This update patches some security issues: CVE-2018-14629: Unprivileged adding o...

Security fix for the ALT Linux 8 package samba version 4.7.12-alt1

4.7.12-alt1 built Nov. 29, 2018 Evgeny Sinelnikov in task 216960 Nov. 27, 2018 Evgeny Sinelnikov - Update to autumn security release - Clean test module of thirdparty/iso8601 and subunit modules - Security fixes: + CVE-2018-14629 Unprivileged adding of CNAME record causing loop in AD Internal DNS...

Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-333-01)

New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-333-01. The text itself is copyright C Slackware Linux...

Debian DSA-4345-1 : samba - security update

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2018-14629 Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by...

Security fix for the ALT Linux 8 package samba-DC version 4.7.12-alt1

4.7.12-alt1 built Nov. 29, 2018 Evgeny Sinelnikov in task 216960 Nov. 27, 2018 Evgeny Sinelnikov - Update to autumn security release - Clean test module of thirdparty/iso8601 and subunit modules - Security fixes: + CVE-2018-14629 Unprivileged adding of CNAME record causing loop in AD Internal DNS...

Samba DoS Vulnerability (CVE-2018-16853)

Samba is prone to a denial of service DoS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Samba 4.9.x Multiple Vulnerabilities (CVE-2018-16852, CVE-2018-16857)

Samba is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Samba 4.x Multiple DoS Vulnerabilities (CVE-2018-14629, CVE-2018-16851)

Samba is prone to multiple denial of service DoS vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Samba DoS Vulnerability (CVE-2018-16841)

Samba is prone to a denial of service DoS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Command injection

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

Null pointer dereference

Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTYZONEMASTERSERVERS property or...

Double free

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call tallocfree twice on the same memory if the principal in a validly signed certificate does not match the principal ...

CVE-2018-14629

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service...

Denial of service

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service...

CVE-2018-16851

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this siz...

CVE-2018-16841

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call tallocfree twice on the same memory if the principal in a validly signed certificate does not match the principal ...

ALPINE-CVE-2018-16851

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this siz...

DEBIAN-CVE-2018-16853

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

ALPINE-CVE-2018-16853

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

CVE-2018-16852

Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTYZONEMASTERSERVERS property or...