Created attachment 273164 [details] net/samba423 4.23.9 upgrade ( still depends on lmdb0-0.9.35 ) Changes since 4.23.8 -------------------- o Ralph Boehme <slow@samba.org> * BUG 16030: Windows Offline Files fails with permission error when directory has the read‑only attribute set o Günther Deschner <gd@samba.org> * BUG 14148: Samba doesn't implement FILE_NOTIFY_CHANGE_SECURITY o Björn Jacke <bjacke@samba.org> * BUG 16076: samba-tool shows wrong format specifiers for timestamp attributes o Volker Lendecke <vl@samba.org> * BUG 16095: Use-after-free in handling acls with claims and conditions o Gary Lockyer <gary@catalyst.net.nz> * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings o Stefan Metzmacher <metze@samba.org> * BUG 14638: restrict anonymous = 2 breaks RODC functionality * BUG 15973: smbpasswd can crash winbindd on an AD DC * BUG 15995: smbd does not cleanup on disconnect of the transport connection on lease break errors * BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba unusable * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare warnings o Andreas Schneider <asn@samba.org> * BUG 15987: Winbind lsa_OpenPolicy() fails on lsa connection setup with: NT_STATUS_RPC_CANNOT_SUPPORT o Shachar Sharon <ssharon@redhat.com> * BUG 16068: CTDB read-only record handling contains use after free and resource leak bugs
There's now a 4.23.10 release with additional security fixes: https://www.samba.org/samba/history/samba-4.23.10.html
Created attachment 273397 [details] net/samba423 4.23.10 upgrade depends on lmdb o CVE-2026-6949: TSIG packet with name compression can crash DNS Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. https://www.samba.org/samba/security/CVE-2026-6949.html o CVE-2026-58216: An authenticated user could possibly crash a KDC process A kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory. This memory is not exposed to the user, but in some circumstances the server could crash. https://www.samba.org/samba/security/CVE-2026-58216.html o CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion An unauthenticated user can repeatedly register names TKEY names, which floods a cache causing legitimate TKEYs to be expunged. This can practically block the use DNS TSIG signing. https://www.samba.org/samba/security/CVE-2026-58218.html o CVE-2026-58221: Samba AD authenticated LDAP access domain takeover Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover. https://www.samba.org/samba/security/CVE-2026-58221.html o CVE-2026-58222: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes An ordinary authenticated domain user can bypass access checks and query confidential Active Directory attributes (such as KDS root keys) via LDAP Compare requests. Due to a filter injection flaw and trusted execution context, the LDAP Compare operation can be turned into a protected-attribute disclosure oracle. https://www.samba.org/samba/security/CVE-2026-58222.html o CVE-2026-58224 The CTDB protocol has bounds checking issues CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. https://www.samba.org/samba/security/CVE-2026-58224.html
Meanwhile 4.23.11 is out, altough it's not a security release.
Created attachment 273462 [details] net/samba423 4.23.11 upgrade depends on lmdb updated
4.23.10 fixes following CVEs CVE-2026-6949, CVE-2026-58216, CVE-2026-58218, CVE-2026-58221, CVE-2026-58222 and CVE-2026-58224. 4.23.11 is general improvement over them.
take
Thanks commited !
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=38e998133ef3bbf5e7b45492af852b16dec88f44 commit 38e998133ef3bbf5e7b45492af852b16dec88f44 Author: Jordan Ostreff <jordan@ostreff.info> AuthorDate: 2026-08-07 06:47:07 +0000 Commit: Xavier Beaudouin <kiwi@FreeBSD.org> CommitDate: 2026-08-07 06:50:53 +0000 net/samba423: update to 4.23.11 Changelog https://www.samba.org/samba/history/samba-4.23.11.html Change dependency to lmdb0 PR: 297043 Reported by: Jordan Ostreff Approved by: samba (kiwi) net/samba423/Makefile | 5 ++--- net/samba423/distinfo | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-)