SUSE-SU-2025:3676-1
Security update for samba
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for samba fixes the following issues: - CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279). - CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280). Update to 4.21.8: * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981). * getpwuid does not shift to new DC when current DC is down; (bso#15844). * Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bso#15876). * kinit command is failing with Missing cache Error; (bso#15840). * Figuring out the DC name from IP address fails and breaks fork_domain_child(); (bso#15891). * Delayed leader broadcast can block ctdb forever; (bso#15892). * 'net ads group' failed to list domain groups; (bso#15900). * Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine); (bso#15663). * Fix handling of empty GPO link; (bso#15877). * SMB ACL inheritance doesn't work for files created; (bso#15880).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 15.7 | ctdb, ldb-tools, libldb-devel and 20 more | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
Show all 23 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise 15.7 | ctdb | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | ldb-tools | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | libldb-devel | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | libldb2 | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | libldb2-32bit | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | python3-ldb | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-ceph | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-client | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-client-libs | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-client-libs-32bit | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-dcerpc | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-devel | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-gpupdate | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-ldb-ldap | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-libs | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-libs-32bit | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-libs-python3 | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-python3 | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-tool | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-winbind | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-winbind-libs | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
| SUSE Linux Enterprise 15.7 | samba-winbind-libs-32bit | 4.21.8+git.418.e80c9b2a88c-150700.3.11.2 |
References
- https://bugzilla.suse.com/1251279
- https://bugzilla.suse.com/1251280
- https://lists.suse.com/pipermail/sle-updates/2025-October/042219.html
- https://www.suse.com/security/cve/CVE-2025-10230/
- https://www.suse.com/security/cve/CVE-2025-9640/
- https://www.suse.com/support/security/rating/
- https://www.suse.com/support/update/announcement/2025/suse-su-20253676-1/