Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

SUSE: Samba Critical Issues Command Injection Memory Disclosure 2025:3676-1

suse
Calendar Grey October 20, 2025
Dist Suse Esm H88
SUSE Linux addresses critical samba vulnerabilities with urgent updates; immediate action is necessary to safeguard systems.
* bsc#1251279 * bsc#1251280 Cross-References: * CVE-2025-10230

Summary

## This update for samba fixes the following issues: * CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279). * CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280). Update to 4.21.8: * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981). * getpwuid does not shift to new DC when current DC is down; (bso#15844). * Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bso#15876). * kinit command is failing with Missing cache Error; (bso#15840). * Figuring out the DC name from IP address fails and breaks fork_domain_child(); (bso#15891). * Delayed leader broadcast can block ctdb forever; (bso#15892). * 'net ads group' failed to list domain groups; (bso#15900).

Topics%20covered

Topics Covered

security advisory critical SuSE samba command injection memory disclosure

References

* bsc#1251279

* bsc#1251280

Cross-

* CVE-2025-10230

* CVE-2025-9640

CVSS scores:

* CVE-2025-10230 ( SUSE ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

* CVE-2025-9640 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

* CVE-2025-9640 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products:

* Basesystem Module 15-SP7

* SUSE Linux Enterprise Desktop 15 SP7

* SUSE Linux Enterprise High Availability Extension 15 SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves two vulnerabilities can now be installed.

##

* https://www.suse.com/security/cve/CVE-2025-10230.html

* https://www.suse.com/security/cve/CVE-2025-9640.html

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:3676-1
Release Date: 2025-10-20T08:26:42Z
Rating: critical

Topics%20covered

Topics Covered

security advisory critical SuSE samba command injection memory disclosure

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here