samba4-4.2.10-12.AXS4

Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

Security Fix(es):

* A use-after-free flaw was found in the way samba servers handled certain SMB1 requests. An unauthenticated attacker could send specially-crafted SMB1 requests to cause the server to crash or execute arbitrary code. (CVE-2017-14746)

* A memory disclosure flaw was found in samba. An attacker could retrieve parts of server memory, which could contain potentially sensitive data, by sending specially-crafted requests to the samba server. (CVE-2017-15275)

Asianux would like to thank the Samba project for reporting these issues. Upstream acknowledges Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam) as the original reporter of CVE-2017-14746; and Volker Lendecke (SerNet and the Samba Team) as the original reporter of CVE-2017-15275.

CVE-2017-14746
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote
attackers to execute arbitrary code via a crafted SMB1 request.
CVE-2017-15275
Samba before 4.7.3 might allow remote attackers to obtain sensitive
information by leveraging failure of the server to clear allocated
heap memory.