samba (2:4.3.11+dfsg-0ubuntu0.16.04.3) xenial-security; urgency=medium * SECURITY UPDATE: remote code execution via heap overflow in NDR parsing - debian/patches/CVE-2016-2123.patch: check lengths in librpc/ndr/ndr_dnsp.c. - CVE-2016-2123 * SECURITY UPDATE: unconditional privilege delegation to Kerberos servers - debian/patches/CVE-2016-2125.patch: don't use GSS_C_DELEG_FLAG in source4/scripting/bin/nsupdate-gss, source3/librpc/crypto/gse.c, source4/auth/gensec/gensec_gssapi.c. - CVE-2016-2125 * SECURITY UPDATE: privilege elevation in Kerberos PAC validation - debian/patches/CVE-2016-2126.patch: only allow known checksum types in auth/kerberos/kerberos_pac.c. - CVE-2016-2126 * This package does _not_ contain the changes from 2:4.3.11+dfsg-0ubuntu0.16.04.2 in xenial-proposed. -- Marc Deslauriers Mon, 12 Dec 2016 08:37:28 -0500 samba (2:4.3.11+dfsg-0ubuntu0.16.04.1) xenial-security; urgency=medium * SECURITY UPDATE: client-signing protection mechanism bypass - Updated to upstream 4.3.11 - CVE-2016-2119 * Removed patches included in new version - debian/patches/samba-bug11912.patch - debian/patches/samba-bug11914.patch -- Marc Deslauriers Fri, 23 Sep 2016 14:00:16 -0400 samba (2:4.3.9+dfsg-0ubuntu0.16.04.3) xenial; urgency=medium * debian/patches/git_smbclient_cpu.patch: - backport upstream patch to fix smbclient users hanging/eating cpu on trying to contact a machine which is not there (lp: #1572260) -- Sebastien Bacher Thu, 11 Aug 2016 10:39:10 +0200 samba (2:4.3.9+dfsg-0ubuntu0.16.04.2) xenial-security; urgency=medium * SECURITY REGRESSION: NTLM authentication issues (LP: #1578576) - debian/patches/samba-bug11912.patch: let msrpc_parse() return talloc'ed empty strings in libcli/auth/msrpc_parse.c. - debian/patches/samba-bug11914.patch: make ntlm_auth_generate_session_info() more complete in source3/utils/ntlm_auth.c. -- Marc Deslauriers Fri, 20 May 2016 07:31:37 -0400 samba (2:4.3.9+dfsg-0ubuntu0.16.04.1) xenial-security; urgency=medium * SECURITY REGRESSION: Updated to 4.3.9 to fix multiple regressions in the previous security updates. (LP: #1577739) - debian/control: bump tevent Build-Depends to 0.9.28. -- Marc Deslauriers Tue, 03 May 2016 07:48:23 -0400 samba (2:4.3.8+dfsg-0ubuntu1) xenial; urgency=medium * SECURITY UPDATE: Updated to 4.3.8 to fix multiple security issues - CVE-2015-5370: Multiple errors in DCE-RPC code - CVE-2016-2110: Man in the middle attacks possible with NTLMSSP - CVE-2016-2111: NETLOGON Spoofing Vulnerability - CVE-2016-2112: The LDAP client and server don't enforce integrity protection - CVE-2016-2113: Missing TLS certificate validation allows man in the middle attacks - CVE-2016-2114: "server signing = mandatory" not enforced - CVE-2016-2115: SMB client connections for IPC traffic are not integrity protected - CVE-2016-2118: SAMR and LSA man in the middle attacks possible * debian/patches/winbind_trusted_domains.patch: make sure domain members can talk to trusted domains DCs. -- Marc Deslauriers Tue, 12 Apr 2016 07:26:29 -0400 samba (2:4.3.6+dfsg-1ubuntu1) xenial; urgency=medium * Merge with Debian; remaining changes: + debian/VERSION.patch: Update vendor string to "Ubuntu". + debian/smb.conf; - Add "(Samba, Ubuntu)" to server string. - Comment out the default [homes] share, and add a comment about "valid users = %s" to show users how to restrict access to \serverusername to only username. + debian/samba-common.config: - Do not change prioritiy to high if dhclient3 is installed. + debian/control: - Switch build depends from transitional libgnutsl28-dev to libgnutls-dev + Add ufw integration: - Created debian/samba.ufw.profile: - debian/rules, debian/samba.install: install profile + Add apport hook: - Created debian/source_samba.py. - debian/rules, debia/samb-common-bin.install: install hook. + d/p/krb_zero_cursor.patch - apply proposed-upstream fix for pam_winbind krb5_ccache_type=FILE failure (LP: #1310919) -- Marc Deslauriers Wed, 09 Mar 2016 08:49:12 -0500 samba (2:4.3.6+dfsg-1) unstable; urgency=medium * New upstream release. + Fixes: - CVE-2015-7560: Incorrect ACL get/set allowed on symlink path. - CVE-2016-0771 (Out-of-bounds read in internal DNS server. -- Jelmer Vernooij Sat, 27 Feb 2016 23:28:53 +0000 samba (2:4.3.5+dfsg-1) unstable; urgency=medium * New upstream release. * Fixed usershare.patch to apply against new version. * Loosen dependencies on ldb to ldb >= 1.1.21, per upstream. * Drop patch sockets-with-htons.patch: applied upstream. * Bump standards version to 3.9.7 (no changes). -- Jelmer Vernooij Sat, 05 Mar 2016 15:56:42 +0000 samba (2:4.3.3+dfsg-2) unstable; urgency=medium [ Jelmer Vernooij ] * Add dependency on libtevent-dev in samba-dev. [ Mathieu Parent ] * Fix CTDB behavior since CVE-2015-8543 (Closes: #813406) -- Mathieu Parent Thu, 04 Feb 2016 13:25:01 +0100 # For older changelog entries, run 'apt-get changelog libwbclient0'