Package "samba"

  samba (2:4.19.5+dfsg-4ubuntu9.4) noble-security; urgency=medium

  * SECURITY UPDATE: uninitialized memory disclosure via vfs_streams_xattr
    - debian/patches/CVE-2025-9640-1.patch: add torture test for inserting
      hole in stream in source3/selftest/tests.py, source4/torture/*.
    - debian/patches/CVE-2025-9640-2.patch: fix unitialized write in
      source3/modules/vfs_streams_xattr.c.
    - CVE-2025-9640
  * SECURITY UPDATE: command injection via WINS server hook script
    - debian/patches/CVE-2025-10230-1.patch: check that wins hook sanitizes
      names in python/samba/tests/usage.py, selftest/*, source4/torture/*,
      testprogs/blackbox/wins_hook_test.
    - debian/patches/CVE-2025-10230-2.patch: restrict names fed to shell in
      source4/nbt_server/wins/wins_hook.c.
    - CVE-2025-10230

 -- Marc Deslauriers <email address hidden> Thu, 09 Oct 2025 09:43:22 -0400

  samba (2:4.19.5+dfsg-4ubuntu9.3) noble; urgency=medium

  * Upcoming changes to Windows Server enforce security checks even on
    schannel secured NETLOGON connections causing winbind's netlogon dc
    discovery calls to fail. (LP: #2116098):
    - d/p/s3-winbindd-use-better-debug-messages-than-talloc_st.patch: use
      better debug messages than 'talloc_strdup failed'
    - d/p/s3-winbindd-avoid-using-any-netlogon-call-to-get-a-d.patch: avoid
      using any netlogon call to get a dc name
    - d/p/s3-winbindd-Fix-internal-winbind-dsgetdcname-calls-w.patch: Fix
      internal winbind dsgetdcname calls w.r.t. domain name
    - d/p/s3-libsmb-let-discover_dc_netbios-return-DOMAIN_CONT.patch: let
      discover_dc_netbios() return DOMAIN_CONTROLLER_NOT_FOUND
    - d/p/s3-libsmb-allow-store_cldap_reply-to-work-with-a-ipv.patch: allow
      store_cldap_reply() to work with a ipv6 response
    - d/p/s3-libsmb-dsgetdcname-use-NETLOGON_NT_VERSION_AVOID_.patch: use
      NETLOGON_NT_VERSION_AVOID_NT4EMUL

 -- Andreas Hasenack <email address hidden> Mon, 21 Jul 2025 17:37:16 -0300

  samba (2:4.19.5+dfsg-4ubuntu9.2) noble; urgency=medium

  * DEP8 test updates:
    - d/t/samba-ad-dc-provisioning-internal-dns: add MOTD GPO test
    - d/t/samba-ad-dc-provisioning-internal-dns: force samba-tool to use
      kerberos when interrogating the DNS server, otherwise it will prompt for
      a password
  * d/p/fix-motd-gpo-list-empty.patch: fix crash when listing an empty MOTD
    GPO (LP: #2107395)
  * d/p/fix-update-motd-gpo.patch: replace patch with upstream's version, which
    includes another fix for the case of updating an existing MOTD GPO
    (LP: #2107395)