MGASA-2020-0205 - Updated samba packages fix security vulnerabilities

Publication date: 08 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0205.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-10700,
     CVE-2020-10704

Updated samba packages fix security vulnerabilities:

A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause
a use-after-free in Samba's AD DC LDAP server (CVE-2020-10700).

A deeply nested filter in an un-authenticated LDAP search can exhaust the
LDAP server's stack memory causing a SIGSEGV (CVE-2020-10704).

The samba package has been updated to version 4.10.15, fixing these issues
and other bugs. The ldb package has been updated to version 1.5.7. The sssd
package has been rebuilt for the updated ldb.

References:
- https://bugs.mageia.org/show_bug.cgi?id=26566
- https://www.samba.org/samba/history/samba-4.10.13.html
- https://www.samba.org/samba/history/samba-4.10.14.html
- https://www.samba.org/samba/history/samba-4.10.15.html
- https://www.samba.org/samba/security/CVE-2020-10700.html
- https://www.samba.org/samba/security/CVE-2020-10704.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10700
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10704

SRPMS:
- 7/core/samba-4.10.15-1.mga7
- 7/core/sssd-1.16.3-3.2.mga7
- 7/core/ldb-1.5.7-1.mga7