Most recent entries from all

ALSA-2022:7730 — Moderate: libldb security, bug fix, and enhancement update

Affected: AlmaLinux:8: ldb-tools, AlmaLinux:8: libldb, AlmaLinux:8: libldb-devel, AlmaLinux:8: python-ldb-devel-common, AlmaLinux:8: python3-ldb, AlmaLinux:8: python3-ldb-devel

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases.

The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077484)

Security Fix(es):

* samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-04911

certfr-2022-avi-686 — De multiples vulnérabilités ont été découvertes dans Samba. Certaines d'entre elles permettent à un attaquant de provoq…

certfr-2022-avi-686

EUVD-2026-17434

fkie_cve-2022-32746

A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

GHSA-hv8p-prvv-v646

gsd-2022-32746

msrc_CVE-2022-32746 — A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values fr…

msrc_CVE-2022-32746

OESA-2022-1798 — samba security update

Affected: openEuler:22.03-LTS: samba

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fix(es): A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.(CVE-2022-32745)

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).(CVE-2022-32742)

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users passwords, enabling full domain takeover.(CVE-2022-32744)

As per samba upstream advisory:All versions of Samba prior to 4.16.x built with Heimdal Kerberos are vulnerable to an Elevation of Privilege attack. If the password of a user expires and need to be changed, a user could get a krbtgt using kpasswd with canonicalization turned on. The KDC sh…

openSUSE-SU-2024:12241-1 — ldb-tools-2.5.2-1.1 on GA media

ldb-tools-2.5.2-1.1 on GA media

UBUNTU-CVE-2022-32746

Affected: Ubuntu:Pro:14.04:LTS: ldb, Ubuntu:Pro:14.04:LTS: samba, Ubuntu:16.04:LTS: ldb, Ubuntu:Pro:16.04:LTS: samba, Ubuntu:18.04:LTS: ldb, Ubuntu:Pro:18.04:LTS: samba, Ubuntu:20.04:LTS: ldb, Ubuntu:20.04:LTS: samba, Ubuntu:22.04:LTS: ldb, Ubuntu:22.04:LTS: samba

WID-SEC-W-2022-0842 — Samba: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Samba ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, einen Denial of Service Zustand zu verursachen oder seine Rechte zu erweitern.