Description
Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create objects - to execute arbitrary commands as root on a machine being joined to that domain.
This issue affects yast2-samba-client through 5.0.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | yast2-samba-client | ≤ 5.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | yast2-samba-client | 4.7.2-150700.3.3.1 | SUSE-SU-2026:3886-1 |
| SLES 15 SP6 | yast2-samba-client | 4.6.2-150600.3.3.1 | SUSE-SU-2026:3887-1 |
| SLES 15 SP5 | yast2-samba-client | 4.5.4-150500.3.3.1 | SUSE-SU-2026:3888-1 |
| SLES 15 SP4 | yast2-samba-client | 4.4.5-150400.3.6.1 | SUSE-SU-2026:3889-1 |
| SLES 12 SP5 | yast2-samba-client | 3.1.25-3.9.1 | SUSE-SU-2026:3890-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | yast2-samba-client | 4.6.2-150600.3.3.1 | SUSE-SU-2026:3887-1 |
| SLES for SAP 15 SP5 | yast2-samba-client | 4.5.4-150500.3.3.1 | SUSE-SU-2026:3888-1 |
| SLES for SAP 15 SP4 | yast2-samba-client | 4.4.5-150400.3.6.1 | SUSE-SU-2026:3889-1 |
| SLE HPC 15 SP5 | yast2-samba-client | 4.5.4-150500.3.3.1 | SUSE-SU-2026:3888-1 |
| SLE HPC 15 SP4 | yast2-samba-client | 4.4.5-150400.3.6.1 | SUSE-SU-2026:3889-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | yast2-samba-client | 5.0.5-1.1 | openSUSE-SU-2026:11762-1 |
Advisories 6
- openSUSE-SU-2026:11762-1 yast2-samba-client-5.0.5-1.1 on GA media SUSE / openSUSE Security Updates · Sep 12, 2026
- SUSE-SU-2026:3887-1 Security update for yast2-samba-client SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3886-1 Security update for yast2-samba-client SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3888-1 Security update for yast2-samba-client SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3889-1 Security update for yast2-samba-client SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3890-1 Security update for yast2-samba-client SUSE / openSUSE Security Updates · Sep 10, 2026
References
- https://bugzilla.suse.com/show_bug.cgi?id=1272776 issue-tracking