MGASA-2018-0023

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2018-0023.html
Import Source
https://advisories.mageia.org/MGASA-2018-0023.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2018-0023
Related
Published
2018-01-02T16:25:41Z
Modified
2018-01-02T16:01:14Z
Summary
Updated samba packages fix security vulnerabilities
Details

Updated samba packages fix security vulnerabilities:

Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a man in the middle attack. (CVE-2017-12150)

Stefan Metzmacher discovered that Samba incorrectly handled encryption across DFS redirects. A remote attacker could use this issue to perform a man in the middle attack. (CVE-2017-12151)

Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when SMB1 is being used. A remote attacker could possibly use this issue to obtain server memory contents. (CVE-2017-12163)

Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when processing certain SMB1 requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2017-14746)

Volker Lendecke discovered that Samba incorrectly cleared memory when returning data to a client. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-15275)

The samba package has been updated to version 4.6.12 to fix these issues and other bugs.

Also, the talloc package has been updated to 2.1.10 and the tevent package has been updated to 0.9.34, as they were needed by the updated samba.

References
Credits

Affected packages

Mageia:6 / samba

Package

Name
samba
Purl
pkg:rpm/mageia/samba?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.6.12-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / talloc

Package

Name
talloc
Purl
pkg:rpm/mageia/talloc?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.10-1.1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / tevent

Package

Name
tevent
Purl
pkg:rpm/mageia/tevent?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.34-1.1.mga6

Ecosystem specific 

{
    "section": "core"
}