samba announce - Jan 2020 - [Announce] Samba 4.11.5, 4.10.12 and 4.9.18 Security Releases Available

Release Announcements
---------------------

These are security releases in order to address the following defects:

o CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD
		  Directory not automatic.        
o CVE-2019-14907: Crash after failed character conversion at log level 3 or
		  above.                                               
o CVE-2019-19344: Use after free during DNS zone scavenging in Samba AD DC.
                                                                                
                                                                                
=======                                                                         
Details                                                                         
=======                                                                         
                                                                                
o  CVE-2019-14902:
   The implementation of ACL inheritance in the Samba AD DC was not complete,
   and so absent a 'full-sync' replication, ACLs could get out of sync
between
   domain controllers. 

o  CVE-2019-14907:
   When processing untrusted string input Samba can read past the end of the
   allocated buffer when printing a "Conversion error" message to the
logs.

o  CVE-2019-19344:
   During DNS zone scavenging (of expired dynamic entries) there is a read of
   memory after it has been freed.

For more details and workarounds, please refer to the security advisories.


Changes:
--------

o  Andrew Bartlett <abartlet at samba.org>
   * BUG 12497: CVE-2019-14902: Replication of ACLs down subtree on AD Directory
     not automatic.
   * BUG 14208: CVE-2019-14907: lib/util: Do not print the failed to convert
     string into the logs.

o  Gary Lockyer <gary at catalyst.net.nz>
   * BUG 14050: CVE-2019-19344: kcc dns scavenging: Fix use after free in
     dns_tombstone_records_zone.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's
Bugzilla
database (https://bugzilla.samba.org/).


======================================================================= Our
Code, Our Bugs, Our Responsibility.
== The Samba Team
=====================================================================


===============Download Details
===============
The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6F33915B6568B7EA).  The source code can be downloaded
from:

        https://download.samba.org/pub/samba/stable/

The release notes are available online at:

        https://www.samba.org/samba/history/samba-4.11.5.html
        https://www.samba.org/samba/history/samba-4.10.12.html
        https://www.samba.org/samba/history/samba-4.9.18.html

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

                        --Enjoy
                        The Samba Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL:
<http://lists.samba.org/pipermail/samba-announce/attachments/20200121/2b4c515d/signature.sig>