Release Planning for Samba 4.16
Samba 4.16 has been marked discontinued.
- Wednesday, July 19 2023 - Samba 4.16.11 has been released as a Security Release to address the following defects:
- CVE-2023-34967 (Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process.)
- CVE-2022-2127 (When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it.)
- CVE-2023-34968 (As part of the Spotlight protocol Samba discloses the server-side absolute path of shares and files and directories in search results.)
- CVE-2023-34966 (An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request.)
- Wednesday, March 29 2023 - Samba 4.16.10 has been released as a Security Release to address the following defects:
- CVE-2023-0922 (The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.)
- CVE-2023-0614 (The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure via LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. Installations with such secrets in their Samba AD should assume they have been obtained and need replacing.)
- Thursday, February 16 2023 - Samba 4.16.9 has been released. There will be security releases only beyond this point.
- Thursday, December 15 2022 - Samba 4.16.8 has been released as a Security Release to address the following defects:
- CVE-2022-37966 (This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022)
- CVE-2022-37967 (This is the Samba CVE for the Windows Kerberos Elevation of Privilege Vulnerability disclosed by Microsoft on Nov 8 2022)
- CVE-2022-38023 (The "RC4" protection of the NetLogon Secure channel uses the same algorithms as rc4-hmac cryptography in Kerberos, and so must also be assumed to be weak)
- Tuesday, November 15 2022 - Samba 4.16.7 has been released as a Security Release to address the following defects:
- CVE-2022-42898 (Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PAC to corrupt the heap)
- Tuesday, October 25 2022 - Samba 4.16.6 has been released as a Security Release to address the following defect:
- CVE-2022-3437 (There is a limited write heap buffer overflow in the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal (included in Samba))
- Wednesday, September 07 2022 - Samba 4.16.5 has been released.
- Wednesday, July 27 2022 - Samba 4.16.4 has been released as a Security Release to address the following defects:
- CVE-2022-2031 (Samba AD users can bypass certain restrictions associated with changing passwords)
- CVE-2022-32744 (Samba AD users can forge password change requests for any user)
- CVE-2022-32745 (Samba AD users can crash the server process with an LDAP add or modify request)
- CVE-2022-32746 (Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request)
- CVE-2022-32742 (Server memory information leak via SMB1)
- Monday, July 18 2022 - Samba 4.16.3 has been released.
- Monday, June 13 2022 - Samba 4.16.2 has been released.
- Monday, May 2 2022 - Samba 4.16.1 has been released.
- Monday, March 21 2022 - Samba 4.16.0 has been released.
- Tuesday, March 8 2022 - Samba 4.16.0rc5 has been released.
- Tuesday, March 1 2022 - Samba 4.16.0rc4 has been released.
- Tuesday, February 15 2022 - Samba 4.16.0rc3 has been released.
- Monday, January 31 2022 - Samba 4.16.0rc2 has been released.
- Monday, January 24 2022 - Samba 4.16.0rc1 has been released.