Samba: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 10.0
  CVE-2025-10230 Public exploit EPSS 40%

  Samba: command injection in wins server hook script

  A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Nov 7, 2025
• Medium 4.3
  CVE-2025-9640

  Samba: vfs_streams_xattr uninitialized memory write possible

  A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an inform…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Oct 15, 2025

Revision history

1. 2026-02-11 #9

   Neue Updates von QNAP aufgenommen

2. 2026-01-29 #8

   Neue Updates von Dell aufgenommen

3. 2025-11-27 #7

   Neue Updates von SUSE aufgenommen

4. 2025-11-26 #6

   Neue Updates von SUSE und Debian aufgenommen

5. 2025-11-23 #5

   Neue Updates von openSUSE aufgenommen

6. 2025-11-09 #4

   Referenz(en) aufgenommen: EUVD-2025-38301

7. 2025-10-20 #3

   Neue Updates von SUSE und Fedora aufgenommen

8. 2025-10-19 #2

   PoC aufgenommen

9. 2025-10-15 #1

   Initiale Fassung

References

• Samba Security Releases vom 2025-10-15
  https://www.samba.org/samba/security/
• Samba Security Advisory CVE-2025-10230 vom 2025-10-15
  https://www.samba.org/samba/security/CVE-2025-10230.html
• Samba-Bugzilla – Bug 15903 vom 2025-10-15
  https://bugzilla.samba.org/show_bug.cgi?id=15903
• Samba Security Advisory CVE-2025-9640 vom 2025-10-15
  https://www.samba.org/samba/security/CVE-2025-9640.html
• Samba-Bugzilla – Bug 15885 vom 2025-10-15
  https://bugzilla.samba.org/show_bug.cgi?id=15885
• SUSE Security Update SUSE-SU-2025:03604-1 vom 2025-10-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/022906.html
• SUSE Security Update SUSE-SU-2025:03618-1 vom 2025-10-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KQBG5DSHQEZYMJRXFXULFV4S7YF3D62B/
• SUSE Security Update SUSE-SU-2025:03612-1 vom 2025-10-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HX5CZG7NWDN6DMNUUMUAOCPYOY5BZQVR/
• SUSE Security Update SUSE-SU-2025:03603-1 vom 2025-10-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/022907.html
• Ubuntu Security Notice USN-7826-1 vom 2025-10-16
  https://ubuntu.com/security/notices/USN-7826-1
• PoC auf GitHub vom 2025-10-19
  https://github.com/dptsec/CVE-2025-10230
• Ubuntu Security Notice USN-7826-2 vom 2025-10-20
  https://ubuntu.com/security/notices/USN-7826-2
• openSUSE Security Update OPENSUSE-SU-2025:15649-1 vom 2025-10-19
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3VBCD3AG7EQ274XF4XWRCUWK65TZC6RT/
• SUSE Security Update SUSE-SU-2025:3676-1 vom 2025-10-20
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/022947.html
• Fedora Security Advisory FEDORA-2025-3DDBDDD7E2 vom 2025-10-20
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-3ddbddd7e2
• SUSE Security Update SUSE-SU-2025:3677-1 vom 2025-10-20
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TNXFMHIDGX5CCACX5YZB4637XOVINTGD/
• Fedora Security Advisory FEDORA-2025-5F46B27E1C vom 2025-10-20
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-5f46b27e1c
• Fedora Security Advisory FEDORA-2025-7D890563F6 vom 2025-10-20
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-7d890563f6
• Fedora Security Advisory FEDORA-2025-C0830FF9F4 vom 2025-10-20
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-c0830ff9f4
• openSUSE Security Update OPENSUSE-SU-2025-20048-1 vom 2025-11-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72NHPHKMITN5ZXSF7A6ULVM4DARRXC62/
• SUSE Security Update SUSE-SU-2025:21005-1 vom 2025-11-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023386.html
• Debian Security Advisory DLA-4384 vom 2025-11-26
  https://lists.debian.org/debian-lts-announce/2025/11/msg00027.html
• SUSE Security Update SUSE-SU-2025:21026-1 vom 2025-11-27
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023406.html
• Dell Security Advisory DSA-2026-030 vom 2026-01-30
  https://www.dell.com/support/kbdoc/de-de/000421570/dsa-2026-030-security-update-for-dell-networker-vproxy-multiple-third-party-component-vulnerabilities
• QNAP Security Advisory QSA-26-06 vom 2026-02-11
  https://www.qnap.com/go/security-advisory/qsa-26-06