Jump to content
Compatible Support Forums
Sign in to follow this  
news

[security-announce] SUSE-SU-2015:0386-1: important: Security update for Samba

Recommended Posts

SUSE Security Update: Security update for Samba

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2015:0386-1

Rating: important

References: #872912 #882356 #883870 #886193 #898031 #899558

#913001 #917376

Cross-References: CVE-2015-0240

Affected Products:

SUSE Linux Enterprise Server 11 SP2 LTSS

______________________________________________________________________________

 

An update that solves one vulnerability and has 7 fixes is

now available.

 

Description:

 

 

Samba has been updated to fix one security issue:

 

* CVE-2015-0240: Don't call talloc_free on an uninitialized pointer

(bnc#917376).

 

Additionally, these non-security issues have been fixed:

 

* Realign the winbind request structure following

require_membership_of field expansion (bnc#913001).

* Reuse connections derived from DFS referrals (bso#10123,

fate#316512).

* Set domain/workgroup based on authentication callback value

(bso#11059).

* Fix spoolss error response marshalling (bso#10984).

* Fix spoolss EnumJobs and GetJob responses (bso#10905, bnc#898031).

* Fix handling of bad EnumJobs levels (bso#10898).

* Fix small memory-leak in the background print process (bnc#899558).

* Prune idle or hung connections older than "winbind request timeout"

(bso#3204, bnc#872912).

* Build: disable mmap on s390 systems (bnc#886193, bnc#882356).

* Only update the printer share inventory when needed (bnc#883870).

* Avoid double-free in get_print_db_byname (bso#10699).

 

Security Issues:

 

* CVE-2015-0240

 

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Server 11 SP2 LTSS:

 

zypper in -t patch slessp2-cifs-mount=10346

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):

 

ldapsmb-1.34b-12.33.43.1

libldb1-3.6.3-0.33.43.1

libsmbclient0-3.6.3-0.33.43.1

libtalloc1-3.4.3-1.54.39

libtalloc2-3.6.3-0.33.43.1

libtdb1-3.6.3-0.33.43.1

libtevent0-3.6.3-0.33.43.1

libwbclient0-3.6.3-0.33.43.1

samba-3.6.3-0.33.43.1

samba-client-3.6.3-0.33.43.1

samba-krb-printing-3.6.3-0.33.43.1

samba-winbind-3.6.3-0.33.43.1

 

- SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):

 

libsmbclient0-32bit-3.6.3-0.33.43.1

libtalloc1-32bit-3.4.3-1.54.39

libtalloc2-32bit-3.6.3-0.33.43.1

libtdb1-32bit-3.6.3-0.33.43.1

libtevent0-32bit-3.6.3-0.33.43.1

libwbclient0-32bit-3.6.3-0.33.43.1

samba-32bit-3.6.3-0.33.43.1

samba-client-32bit-3.6.3-0.33.43.1

samba-winbind-32bit-3.6.3-0.33.43.1

 

- SUSE Linux Enterprise Server 11 SP2 LTSS (noarch):

 

samba-doc-3.6.3-0.33.43.1

 

 

References:

 

http://support.novell.com/security/cve/CVE-2015-0240.html

https://bugzilla.suse.com/872912

https://bugzilla.suse.com/882356

https://bugzilla.suse.com/883870

https://bugzilla.suse.com/886193

https://bugzilla.suse.com/898031

https://bugzilla.suse.com/899558

https://bugzilla.suse.com/913001

https://bugzilla.suse.com/917376

http://download.suse.com/patch/finder/?keywords=d8d66713b0b31cf585ddfd4a751c7eec

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×