Lucene search

K
suseSuseSUSE-SU-2016:0164-1
HistoryJan 19, 2016 - 1:11 p.m.

Security update for samba (important)

2016-01-1913:11:48
lists.opensuse.org
49

0.015 Low

EPSS

Percentile

85.6%

This update for Samba fixes the following security issues:

  • CVE-2015-5330: Remote read memory exploit in LDB (bnc#958586)
  • CVE-2015-5252: Insufficient symlink verification (file access outside
    the share) (bnc#958582)
  • CVE-2015-5296: No man in the middle protection when forcing smb
    encryption on the client side (bnc#958584)
  • CVE-2015-5299: Currently the snapshot browsing is not secure thru
    windows previous version (shadow_copy2) (bnc#958583)

Non-security issues fixed:

  • Prevent null pointer access in samlogon fallback when security
    credentials are null (bnc#949022)
  • Ensure samlogon fall-back requests are rerouted after kerberos failure
    (bnc#953382)
  • Ensure "Your account is disabled" message is displayed when attempting
    to ssh into locked account (bnc#953382)
  • Address unrecoverable winbind failure: "key length too large"
    (bnc#934299)
  • Take resource group sids into account when caching netsamlogon data
    (bnc#912457)
  • Fix lookup of groups with "Local Domain" scope from Active Directory
    (bnc#948244)
  • dependency issue with samba-winbind (bnc#936909)