Mageia alert MGASA-2020-0410 (samba)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2020-0410: Updated samba packages fix security vulnerabilities
Date:
             
 
Tue, 10 Nov 2020 16:21:09 +0100
Message-ID:
             
 
<20201110152109.726F89F6EB@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2020-0410 - Updated samba packages fix security vulnerabilities

Publication date: 10 Nov 2020
URL: https://advisories.mageia.org/MGASA-2020-0410.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-14318,
     CVE-2020-14323,
     CVE-2020-14383

Description:
Steven French discovered that Samba incorrectly handled ChangeNotify
permissions. A remote attacker could possibly use this issue to obtain file
name information (CVE-2020-14318).

Bas Alberts discovered that Samba incorrectly handled certain winbind
requests. A remote attacker could possibly use this issue to cause winbind to
crash, resulting in a denial of service (CVE-2020-14323).

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain
invalid DNS records. A remote attacker could possibly use this issue to cause
the DNS server to crash, resulting in a denial of service (CVE-2020-14383).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27488
- https://www.samba.org/samba/security/CVE-2020-14318.html
- https://www.samba.org/samba/security/CVE-2020-14323.html
- https://www.samba.org/samba/security/CVE-2020-14383.html
- https://ubuntu.com/security/notices/USN-4611-1
- https://lists.suse.com/pipermail/sle-security-updates/202...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1...

SRPMS:
- 7/core/samba-4.10.18-1.1.mga7