Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Samba may let attackers overwrite files or escape directories
published 5 months ago
Summary
The Oracle Samba packages (libsmbclient, samba, samba-client, samba-common) can be tricked into writing registry files outside the intended area or following malicious path names, which could let an attacker change or read data they shouldn't. This risk is mitigated by applying the latest Samba updates that block those special file operations. Make sure your systems are running the newest Oracle Samba release and apply any pending patches promptly.
What to do
- Update oracle libsmbclient to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle libsmbclient-devel to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-client to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-common to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-doc to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-domainjoin-gui to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-glusterfs to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-swat to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-winbind to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-winbind-clients to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-winbind-devel to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
- Update oracle samba-winbind-krb5-locator to version 3.6.23-53.0.1.el6_10.tuxcare.ol.els6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | libsmbclient |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | libsmbclient-devel |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-client |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-common |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-doc |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-domainjoin-gui |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-glusterfs |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-swat |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-winbind |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-winbind-clients |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-winbind-devel |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | samba-winbind-krb5-locator |
< 3.6.23-53.0.1.el6_10.tuxcare.ol.els6 Fix: upgrade to 3.6.23-53.0.1.el6_10.tuxcare.ol.els6
|
Original advisory text
samba: Fix of 4 CVEs
- CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing
registry hive files outside intended share boundaries via symlink races
- CVE-2019-10218: Reject server-supplied filenames containing path
separators in SMB1 directory listings to protect libsmbclient consumers
from path traversal attacks
- CVE-2018-1050: Already fixed - upstream patch 0207 applied since the
initial import
- CVE-2019-3824: Not affected - the vulnerable ldb_tdb / AD DC code lives
in source4, which is not built by this spec (samba_source = source3)
registry hive files outside intended share boundaries via symlink races
- CVE-2019-10218: Reject server-supplied filenames containing path
separators in SMB1 directory listings to protect libsmbclient consumers
from path traversal attacks
- CVE-2018-1050: Already fixed - upstream patch 0207 applied since the
initial import
- CVE-2019-3824: Not affected - the vulnerable ldb_tdb / AD DC code lives
in source4, which is not built by this spec (samba_source = source3)
References
Timeline
Published28 May 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1779959962 · OSV
Track software like this
Free during beta