diff options
author | Karolin Seeger <kseeger@samba.org> | 2009-06-22 23:04:29 +0200 |
---|---|---|
committer | Karolin Seeger <kseeger@samba.org> | 2009-06-22 23:04:29 +0200 |
commit | c5a0590a2efb9c0e8565e822dfc7cea92af0bece (patch) | |
tree | b61e488f151cb8f6bea63b5bb6214a6dcaa8be46 | |
parent | d85b881d66841a5dac66a98a94f251f58d66d1c4 (diff) | |
download | samba-c5a0590a2efb9c0e8565e822dfc7cea92af0bece.tar.gz samba-c5a0590a2efb9c0e8565e822dfc7cea92af0bece.tar.xz samba-c5a0590a2efb9c0e8565e822dfc7cea92af0bece.zip |
WHATSNEW: Update changes.
Karolin
-rw-r--r-- | WHATSNEW.txt | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 173b21f11e5..8b34c13bd46 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -4,14 +4,19 @@ ============================== -This is a security release in order to address CVE-2009-1886. +This is a security release in order to address CVE-2009-1886 and CVE-2009-1888. - o CVE-2009-1886. + o CVE-2009-1886: In Samba 3.2.0 to 3.2.12 (inclusive), the smbclient commands dealing with file names treat user input as a format string to asprintf. With a maliciously crafted file name smbclient can be made to execute code triggered by the server. + o CVE-2009-1888: + In Samba 3.0.31 to 3.3.5 (inclusive), an uninitialized read of a data + value can potentially affect access control when "dos filemode" + is set to "yes". + ###################################################################### Changes @@ -21,8 +26,9 @@ Changes since 3.2.12 -------------------- -o Volker Lendecke <vl@samba.org> +o Jeremy Allison <jra@samba.org> * Fix for CVE-2009-1886. + * Fix for CVE-2009-1888. ###################################################################### |