MGASA-2020-0058
- Source
- https://advisories.mageia.org/MGASA-2020-0058.html
- Import Source
- https://advisories.mageia.org/MGASA-2020-0058.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2020-0058
- Related
- Published
- 2020-01-28T07:52:40Z
- Modified
- 2020-01-28T07:30:22Z
- Summary
- Updated samba packages fix security vulnerabilities
- Details
-
The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers (CVE-2019-14902).
When processing untrusted string input Samba can read past the end of the allocated buffer when printing a "Conversion error" message to the logs. This can cause a crash after the failed character conversion when operating at log level 3 or above (CVE-2019-14907).
During DNS zone scavenging (of expired dynamic entries) in a Samba AD DC, there is a read of memory after it has been freed (CVE-2019-19344).
Note that manual intervention is required to fully implement the fix for CVE-2019-14902. See the upstream advisory for details.
- References
-
- https://advisories.mageia.org/MGASA-2020-0058.html
- https://bugs.mageia.org/show_bug.cgi?id=26113
- https://usn.ubuntu.com/4244-1/
- https://www.samba.org/samba/security/CVE-2019-14902.html
- https://www.samba.org/samba/security/CVE-2019-14907.html
- https://www.samba.org/samba/security/CVE-2019-19344.html
- https://www.samba.org/samba/history/samba-4.10.12.html
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:7 / samba
Package
- Name
- samba
- Purl
- pkg:rpm/mageia/samba?distro=mageia-7