Linux · Security advisory · November 11, 2023

ELSA-2023-6667: Security update for 36 packages

ELSA-2023-6667, released November 11, 2023, fixes 4 CVEs across 36 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.6240
99th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
evolution-mapiol 90:3.40.1-6.el9
evolution-mapi-langpacksol 90:3.40.1-6.el9
libnetapiol 90:4.18.6-100.el9
libnetapi-develol 90:4.18.6-100.el9
libsmbclientol 90:4.18.6-100.el9
libsmbclient-develol 90:4.18.6-100.el9
libwbclientol 90:4.18.6-100.el9
libwbclient-develol 90:4.18.6-100.el9
openchangeol 90:2.3-41.el9
python3-sambaol 90:4.18.6-100.el9
python3-samba-dcol 90:4.18.6-100.el9
python3-samba-develol 90:4.18.6-100.el9
python3-samba-testol 90:4.18.6-100.el9
sambaol 90:4.18.6-100.el9
samba-clientol 90:4.18.6-100.el9
samba-client-libsol 90:4.18.6-100.el9
samba-commonol 90:4.18.6-100.el9
samba-common-libsol 90:4.18.6-100.el9
samba-common-toolsol 90:4.18.6-100.el9
samba-dc-libsol 90:4.18.6-100.el9
samba-dcerpcol 90:4.18.6-100.el9
samba-develol 90:4.18.6-100.el9
samba-krb5-printingol 90:4.18.6-100.el9
samba-ldb-ldap-modulesol 90:4.18.6-100.el9
samba-libsol 90:4.18.6-100.el9
samba-pidlol 90:4.18.6-100.el9
samba-testol 90:4.18.6-100.el9
samba-test-libsol 90:4.18.6-100.el9
samba-toolsol 90:4.18.6-100.el9
samba-usersharesol 90:4.18.6-100.el9
samba-vfs-iouringol 90:4.18.6-100.el9
samba-winbindol 90:4.18.6-100.el9
samba-winbind-clientsol 90:4.18.6-100.el9
samba-winbind-krb5-locatorol 90:4.18.6-100.el9
samba-winbind-modulesol 90:4.18.6-100.el9
samba-winexeol 90:4.18.6-100.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-34966 ctdb: An infinite loop vulnerability was found in Samba's mdssvc RPC service forSpotlight 7.5 0.6240 None reported
High CVE-2023-34967 samba: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight 7.5 0.6120 None reported
High CVE-2022-2127 ldb-tools: An out-of-bounds read vulnerability was found in Samba due to insufficientlength checks in winbindd_pam_auth_crap.c 7.5 0.0172 None reported
High CVE-2023-34968 libnss-winbind: A path disclosure vulnerability was found in Samba 7.5 0.0133 None reported
Showing 1 to 4 of 4 1