CLSA-2026-1786494875 Fix CVE(s): CVE-2022-38023

SECURITY UPDATE: netlogon secure channel allowed RC4/HMAC-MD5 downgrade and unsealed unencrypted use, permitting man-in-the-middle attacks - debian/patches/CVE-2022-38023.patch: change "reject md5 clients" and "reject md5 servers" defaults to yes, deprecate "allow nt4 crypto" and "reject md5...

CLSA-2026-1782159797 Fix CVE(s): CVE-2026-3238

CVE-2026-3238: source4 WINS server NULL pointer dereference in nbtdwinsserverregister/query/release; craft NBT packets with qdcount=0, arcount=0, or empty netbios addresses crash the nbt process on servers running wins support = yes typical AD DC role. Fix dissolves direct variable initialization...

CLSA-2026-1773667921 Fix CVE(s): CVE-2025-10230

SECURITY UPDATE: unauthenticated command injection via WINS hook in source4 NBT server. The "wins hook" parameter passed unsanitized NetBIOS names to a shell command, allowing arbitrary command execution by remote clients. - debian/patches/CVE-2025-10230.patch - CVE-2025-10230...