Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7: MGASA-2020-0205 Critical: Samba Use-After-Free and SIGSEGV

mageia
Calendar Grey May 8, 2020
Dist Mageia Esm H88
Revised Samba software for Mageia addresses significant security vulnerabilities impacting LDAP service.
Updated samba packages fix security vulnerabilities: A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server (CVE-20...

Summary

Updated samba packages fix security vulnerabilities:
A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a use-after-free in Samba's AD DC LDAP server (CVE-2020-10700).
A deeply nested filter in an un-authenticated LDAP search can exhaust the LDAP server's stack memory causing a SIGSEGV (CVE-2020-10704).
The samba package has been updated to version 4.10.15, fixing these issues and other bugs. The ldb package has been updated to version 1.5.7. The sssd package has been rebuilt for the updated ldb.

References

- https://bugs.mageia.org/show_bug.cgi?id=26566

-

-

-

-

-

- https://www.cve.org/CVERecord?id=CVE-2020-10700

- https://www.cve.org/CVERecord?id=CVE-2020-10704

Topics%20covered

Topics Covered

security advisory security update samba LDAP use-after-free mageia sigsegv

Resolution

SRPMS

- 7/core/samba-4.10.15-1.mga7

- 7/core/sssd-1.16.3-3.2.mga7

- 7/core/ldb-1.5.7-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 08 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0205.html
Type: security
CVE: CVE-2020-10700, CVE-2020-10704

Topics%20covered

Topics Covered

security advisory security update samba LDAP use-after-free mageia sigsegv

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here