Karolin Seeger
2020-Apr-28 08:10 UTC
[Announce] Samba 4.12.2, 4.11.8 and 4.10.15 Security Releases Available
Release Announcements --------------------- These are a security releases in order to address the following defects: o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC ======Details ====== o CVE-2020-10700: A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server. o CVE-2020-10704: A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing a SIGSEGV. For more details, please refer to the security advisories. Changes: -------- o Andrew Bartlett <abartlet at samba.org> * BUG 14331: CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and paged_results combined. o Gary Lockyer <gary at catalyst.net.nz> * BUG 20454: CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in Samba AD DC. ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ======================================================================= Our Code, Our Bugs, Our Responsibility. == The Samba Team ===================================================================== ===============Download Details =============== The uncompressed tarballs and patch files have been signed using GnuPG (ID 6F33915B6568B7EA). The source code can be downloaded from: https://download.samba.org/pub/samba/stable/ The release notes are available online at: https://www.samba.org/samba/history/samba-4.12.2.html https://www.samba.org/samba/history/samba-4.11.8.html https://www.samba.org/samba/history/samba-4.10.15.html Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/) --Enjoy The Samba Team -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 195 bytes Desc: not available URL: <http://lists.samba.org/pipermail/samba-announce/attachments/20200428/007e6c29/signature.sig>
Apparently Analagous Threads
- [Announce] Samba 4.12.2, 4.11.8 and 4.10.15 Security Releases Available
- Changelogs of latest packages on repo for 4.10.15/4.11.8/4.12.2
- [Announce] Samba 4.12.4, 4.11.11 and 4.10.17 Security Releases Available
- [Announce] Samba 4.12.4, 4.11.11 and 4.10.17 Security Releases Available
- Samba4 KDC - no such entry found in hdb