Most recent entries from all

ALSA-2026:22644 — Important: samba security update

Affected: AlmaLinux:8: ctdb, AlmaLinux:8: libnetapi, AlmaLinux:8: libnetapi-devel, AlmaLinux:8: libsmbclient, AlmaLinux:8: libsmbclient-devel, AlmaLinux:8: libwbclient, AlmaLinux:8: libwbclient-devel, AlmaLinux:8: python3-samba, AlmaLinux:8: python3-samba-dc, AlmaLinux:8: python3-samba-devel and 24 more

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

* samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07422

certfr-2026-avi-0651 — De multiples vulnérabilités ont été découvertes dans Samba. Certaines d'entre elles permettent à un attaquant de provoq…

certfr-2026-avi-0651

EUVD-2026-380624

fkie_cve-2026-3012

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

GHSA-59rx-q76w-hqrw

OESA-2026-2574 — samba security update

Affected: openEuler:22.03-LTS-SP4: samba

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n fil…

RHSA-2026:22644 — Red Hat Security Advisory: samba security update

samba: Missing access check on reparse point operations samba: vfs_worm does not block directory modification samba: group policy certificate enrollment uses http:// without validation samba: Remote Code Execution in SAMR samba: Samba: Remote Code Execution in printing subsystem via unescaped job description

RHSA-2026:28053 — Red Hat Security Advisory: samba security update

RLSA-2026:22644 — Important: samba security update

Affected: Rocky Linux:8: samba

Security Fix(es):

* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

* samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

* samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-3012

Affected: Ubuntu:24.04:LTS: samba, Ubuntu:25.10: samba, Ubuntu:26.04:LTS: samba

WID-SEC-W-2026-1686 — Samba: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Samba ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.