rpm package
suse/ldb&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4
pkg:rpm/suse/ldb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-0922 | — | < 2.4.4-150400.4.11.1 | 2.4.4-150400.4.11.1 | Apr 3, 2023 | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. | ||
| CVE-2023-0614 | — | < 2.4.4-150400.4.11.1 | 2.4.4-150400.4.11.1 | Apr 3, 2023 | The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. | ||
| CVE-2023-0225 | — | < 2.4.4-150400.4.11.1 | 2.4.4-150400.4.11.1 | Apr 3, 2023 | A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory. | ||
| CVE-2022-32746 | — | < 2.4.3-150400.4.8.1 | 2.4.3-150400.4.8.1 | Aug 25, 2022 | A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAc | ||
| CVE-2022-32745 | — | < 2.4.3-150400.4.8.1 | 2.4.3-150400.4.8.1 | Aug 25, 2022 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault. | ||
| CVE-2022-32744 | — | < 2.4.3-150400.4.8.1 | 2.4.3-150400.4.8.1 | Aug 25, 2022 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover. | ||
| CVE-2022-32742 | — | < 2.4.3-150400.4.8.1 | 2.4.3-150400.4.8.1 | Aug 25, 2022 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control | ||
| CVE-2022-2031 | — | < 2.4.3-150400.4.8.1 | 2.4.3-150400.4.8.1 | Aug 25, 2022 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tic | ||
| CVE-2021-3670 | — | < 2.4.2-150400.4.3.11 | 2.4.2-150400.4.3.11 | Aug 23, 2022 | MaxQueryDuration not honoured in Samba AD DC LDAP |
- CVE-2023-0922Apr 3, 2023affected < 2.4.4-150400.4.11.1fixed 2.4.4-150400.4.11.1
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
- CVE-2023-0614Apr 3, 2023affected < 2.4.4-150400.4.11.1fixed 2.4.4-150400.4.11.1
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
- CVE-2023-0225Apr 3, 2023affected < 2.4.4-150400.4.11.1fixed 2.4.4-150400.4.11.1
A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
- CVE-2022-32746Aug 25, 2022affected < 2.4.3-150400.4.8.1fixed 2.4.3-150400.4.8.1
A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAc
- CVE-2022-32745Aug 25, 2022affected < 2.4.3-150400.4.8.1fixed 2.4.3-150400.4.8.1
A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.
- CVE-2022-32744Aug 25, 2022affected < 2.4.3-150400.4.8.1fixed 2.4.3-150400.4.8.1
A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.
- CVE-2022-32742Aug 25, 2022affected < 2.4.3-150400.4.8.1fixed 2.4.3-150400.4.8.1
A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control
- CVE-2022-2031Aug 25, 2022affected < 2.4.3-150400.4.8.1fixed 2.4.3-150400.4.8.1
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tic
- CVE-2021-3670Aug 23, 2022affected < 2.4.2-150400.4.3.11fixed 2.4.2-150400.4.3.11
MaxQueryDuration not honoured in Samba AD DC LDAP