Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

SUSE 15-SP3: 2021:3187-1 Important: Samba Buffer Overrun Fix

suse
Calendar Grey September 22, 2021
Scroller Suse
SUSE has rolled out a security patch addressing severe samba flaws with an upgrade that delivers robust fixes.
An update that solves three vulnerabilities and has two fixes is now available

Summary

This update for samba fixes the following issues: - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574). - CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677). - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572). - Spec file fixes around systemd and requires (bsc#1182830) - Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875) - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Python2 15-SP3:

Topics%20covered

Topics Covered

security advisory remote code execution buffer overrun samba important out of bounds python module

References

#1182830 #1183572 #1183574 #1184677 #1189875

Cross- CVE-2020-27840 CVE-2021-20254 CVE-2021-20277

CVSS scores:

CVE-2020-27840 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2020-27840 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-20254 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVE-2021-20254 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

CVE-2021-20277 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-20277 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected Products:

SUSE Linux Enterprise Module for Python2 15-SP3

SUSE Linux Enterprise Module for Basesystem 15-SP3

SUSE Linux Enterprise High Availability 15-SP3

https://www.suse.com/security/cve/CVE-2020-27840.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:3187-1
Rating: important

Topics%20covered

Topics Covered

security advisory remote code execution buffer overrun samba important out of bounds python module

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.