CVE-2025-9640

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A vulnerability has been found in Samba (File Transfer Software) (the affected version is unknown) and classified as critical.The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-10230)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. (CVE-2018-14628) Command injection in wins server hook script. (CVE-2025-10230) vfs_streams_xattr uninitialized memory write possible. (CVE-2025-9640)

These are all security issues fixed in the ctdb-4.22.5+git.431.dc5a539f124-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

This update for samba fixes the following issues:

Update to 4.22.5:

• CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280).
• CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).

• Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087).

• Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181).

• Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180).

• don't attempt to label paths that don't exist, also remove unecessary evaluation of semange & restorecon cmds (bsc#1249179).

Update to 4.22.4:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0
• getpwuid does not shift to new DC when current DC is down
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName-
• Unresponsive second DC can cause idmapping failure when using idmap_ad-
• kinit command is failing with Missing cache Error.
• Figuring out the DC name from IP address fails and breaks fork_domain_child().
• vfs_streams_depot fstatat broken.
• Delayed leader broadcast can block ctdb forever.
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine).
• Fix handling of empty GPO link.
• SMB ACL inheritance doesn't work for files created.

• adjust gpgme build dependency for future-proofing

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

Update to 4.21.8:

• netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981).
• getpwuid does not shift to new DC when current DC is down; (bso#15844).
• Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bso#15876).
• kinit command is failing with Missing cache Error; (bso#15840).
• Figuring out the DC name from IP address fails and breaks fork_domain_child(); (bso#15891).
• Delayed leader broadcast can block ctdb forever; (bso#15892).
• 'net ads group' failed to list domain groups; (bso#15900).
• Apparently there is a conflict between shadow_copy2 module and virusfilter (action quarantine); (bso#15663).
• Fix handling of empty GPO link; (bso#15877).
• SMB ACL inheritance doesn't work for files created; (bso#15880).

This update for samba fixes the following issues:

• CVE-2025-9640: Fixed vfs_streams_xattr uninitialized memory write (bsc#1251279).
• CVE-2025-10230: Fixed command Injection in WINS Server Hook Script (bsc#1251280).

Andrew Walker discovered that Samba incorrectly initialized memory in the vfs_streams_xattr module. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2025-9640)

Igor Morgenstern discovered that Samba incorrectly handled names passed to the WINS hook program. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-10230)

USN-7826-1 fixed vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

Andrew Walker discovered that Samba incorrectly initialized memory in the vfs_streams_xattr module. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2025-9640)

Igor Morgenstern discovered that Samba incorrectly handled names passed to the WINS hook program. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-10230)