Mageia alert MGASA-2020-0205 (samba)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0205: Updated samba packages fix security vulnerabilities 
Date:
             
 
Fri, 8 May 2020 12:58:57 +0200
Message-ID:
             
 
<20200508105857.1EB4B9F641@duvel.mageia.org>
MGASA-2020-0205 - Updated samba packages fix security vulnerabilities

Publication date: 08 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0205.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-10700,
     CVE-2020-10704

Description:
Updated samba packages fix security vulnerabilities:

A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause
a use-after-free in Samba's AD DC LDAP server (CVE-2020-10700).

A deeply nested filter in an un-authenticated LDAP search can exhaust the
LDAP server's stack memory causing a SIGSEGV (CVE-2020-10704).

The samba package has been updated to version 4.10.15, fixing these issues
and other bugs. The ldb package has been updated to version 1.5.7. The sssd
package has been rebuilt for the updated ldb.

References:
- https://bugs.mageia.org/show_bug.cgi?id=26566
- https://www.samba.org/samba/history/samba-4.10.13.html
- https://www.samba.org/samba/history/samba-4.10.14.html
- https://www.samba.org/samba/history/samba-4.10.15.html
- https://www.samba.org/samba/security/CVE-2020-10700.html
- https://www.samba.org/samba/security/CVE-2020-10704.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...

SRPMS:
- 7/core/samba-4.10.15-1.mga7
- 7/core/sssd-1.16.3-3.2.mga7
- 7/core/ldb-1.5.7-1.mga7