CVE-2025-10230

CVE-2025-10230 involves Samba’s front-end WINS hook where NetBIOS names from registration packets are inserted into a shell without proper validation or escaping, enabling unauthenticated remote code execution as the Samba process. The issue is rooted in unsanitized NetBIOS data in WINS registrat...

CVE-2025-10230 Samba: command injection in wins server hook script

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active...

EUVD-2025-38301

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active...

Samba 操作系统命令注入漏洞

Samba is Samba open source a standard Windows interoperability program suite for Linux and Unix. Samba suffers from an operating system command injection vulnerability that stems from a lack of proper validation or escaping of NetBIOS names in front-end WINS hook processing, which could lead to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990603)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990603 advisory. In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uncleared server-smbdconn in reconnect In smbddestroy, clear the...

Samba Information Disclosure (CVE-2025-9640)

In the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability. Note that Nessus has not tested for...

Samba Installed (Linux)

Binary data sambalinuxinstalled.nbin...

Samba WINS hook RCE (CVE-2025-10230)

In the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller's...

[SECURITY] Fedora 42 Update: samba-4.22.6-1.fc42

Samba is the standard Windows interoperability suite of programs for Linux and Unix...

Fedora 42 : samba (2025-7d890563f6)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-7d890563f6 advisory. Update to Samba 4.22.6 - Security fix for CVE-2025-9640 and CVE-2025-10230 Tenable has extracted the preceding description block directly from the...

Fedora: Security Advisory (FEDORA-2025-7d890563f6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ksmbd: prevent connection release during oplock break notification

...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. The smbd service daemon does not detect changes in group membership when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then reconnect...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba, specifically in the vfsstreamsxattr module. In this module, uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content, which may include sensitive data, resulting in an information...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A null pointer dereference issue in destroyprevioussession has been fixed. If the -PreviousSessionId is set during the Kerberos session setup phase, a null pointer dereference error may occur. Since sess-user is not set ye...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba, particularly in the handling of the front-end WINS hook: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets is inserted into shell commands and executed b...

OESA-2025-2539 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A vulnerability has been found in Samba File Transfer Software the affected version is unknown and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or...

SUSE CVE-2025-40090

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 "ksmbd: Fix race condition in RPC handle list access", ksmbdsessionrpcmethod attempts to lock sess-rpclock. This causes hung connections / tasks wh...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2025-988620)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988620 advisory. A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2025-988619)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988619 advisory. Unity Link Advisory UTSA-2025-988619 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...