SUSE-SU-2025:03604-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2025:03604-1

MEDIUM4.3

Security update for samba

Published Oct 15, 2025

Modified 7 months ago

Fix available

Details

Description of the patch:

This update for samba fixes the following issues:

CVE-2025-9640: Fixed uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279).
CVE-2025-10230: Fixed command Injection in WINS server hook script (bsc#1251280).

Affected Packages(23 packages)

ctdb

SUSE Linux Enterprise High Availability Extension 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

libsamba-policy-devel

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

libsamba-policy-python3-devel

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

libsamba-policy0-python3

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

libsamba-policy0-python3-32bit

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

samba

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

samba-client

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

samba-client-32bit

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

samba-client-libs

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

samba-client-libs-32bit

SUSE Linux Enterprise Server 12 SP5-LTSSSUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Fixed in:

4.15.13+git.664.e8416d8d213-3.99.1

References

https://bugzilla.suse.com/1251279

https://bugzilla.suse.com/1251280

https://lists.suse.com/pipermail/sle-updates/2025-October/042172.html

https://www.suse.com/security/cve/CVE-2025-10230/

https://www.suse.com/security/cve/CVE-2025-9640/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2025/suse-su-202503604-1/

CVSS Analysis

CVSS v3.1

4.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

4.3/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Upstream

CVE-2025-10230 CVE-2025-9640

Ecosystems

SUSE Linux Enterprise High Availability Extension 12 SP5 SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

Timeline

PublishedOct 15, 2025

ModifiedOct 15, 2025