samba - Debian Package Tracker

general

source: samba (main)
version: 2:4.24.4+dfsg-1
maintainer: Debian Samba Maintainers (archive) (DMD)
uploaders: Mathieu Parent [DMD] – Michael Tokarev [DMD] – Jelmer Vernooĳ [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:4.13.13+dfsg-1~deb11u6
o-o-sec: 2:4.13.13+dfsg-1~deb11u8
oldstable: 2:4.17.12+dfsg-0+deb12u4
old-sec: 2:4.17.12+dfsg-0+deb12u4
old-bpo: 2:4.22.6+dfsg-0+deb13u1~bpo12+1
old-upd: 2:4.17.12+dfsg-0+deb12u2
old-p-u: 2:4.17.12+dfsg-0+deb12u4
stable: 2:4.22.10+dfsg-0+deb13u1
stable-sec: 2:4.22.8+dfsg-0+deb13u2
stable-bpo: 2:4.24.4+dfsg-1~bpo13+1
testing: 2:4.24.4+dfsg-1
unstable: 2:4.24.4+dfsg-1

versioned links

2:4.13.13+dfsg-1~deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.13.13+dfsg-1~deb11u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.17.12+dfsg-0+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.6+dfsg-0+deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.8+dfsg-0+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.22.10+dfsg-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.24.4+dfsg-1~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:4.24.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ctdb
ldb-tools
libldb-dev
libldb2
libnss-winbind
libpam-winbind (1 bugs: 0, 0, 1, 0)
libsmbclient
libsmbclient-dev (1 bugs: 0, 0, 1, 0)
libsmbclient0
libtalloc-dev
libtalloc2
libtdb-dev
libtdb1
libtevent-dev
libtevent0
libtevent0t64
libwbclient-dev
libwbclient0
python3-ldb
python3-samba
python3-talloc
python3-tdb
registry-tools
samba (32 bugs: 0, 25, 7, 0)
samba-ad-dc
samba-ad-provision
samba-common
samba-common-bin (3 bugs: 0, 1, 2, 0)
samba-dev
samba-dsdb-modules
samba-libs
samba-testsuite
samba-vfs-ceph
samba-vfs-glusterfs
samba-vfs-modules
smbclient (7 bugs: 0, 5, 2, 0)
tdb-tools
winbind (4 bugs: 0, 4, 0, 0)

action needed

7 security issues in trixie high

There are 7 open security issues in trixie.

7 important issues:

CVE-2026-6949:
CVE-2026-15779: A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
CVE-2026-58216:
CVE-2026-58218:
CVE-2026-58221:
CVE-2026-58222:
CVE-2026-58224:

Created: 2026-07-20 Last update: 2026-07-28 14:00

7 security issues in sid high

There are 7 open security issues in sid.

7 important issues:

CVE-2026-6949:
CVE-2026-15779: A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
CVE-2026-58216:
CVE-2026-58218:
CVE-2026-58221:
CVE-2026-58222:
CVE-2026-58224:

Created: 2026-07-20 Last update: 2026-07-28 14:00

7 security issues in forky high

There are 7 open security issues in forky.

7 important issues:

CVE-2026-6949:
CVE-2026-15779: A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
CVE-2026-58216:
CVE-2026-58218:
CVE-2026-58221:
CVE-2026-58222:
CVE-2026-58224:

Created: 2026-07-20 Last update: 2026-07-28 14:00

7 security issues in bookworm high

There are 7 open security issues in bookworm.

6 important issues:

CVE-2026-6949:
CVE-2026-58216:
CVE-2026-58218:
CVE-2026-58221:
CVE-2026-58222:
CVE-2026-58224:

1 issue left for the package maintainer to handle:

CVE-2026-15779: (postponed; to be fixed through a stable update) A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-20 Last update: 2026-07-28 14:00

27 security issues in bullseye high

There are 27 open security issues in bullseye.

6 important issues:

CVE-2026-6949:
CVE-2026-58216:
CVE-2026-58218:
CVE-2026-58221:
CVE-2026-58222:
CVE-2026-58224:

1 issue postponed or untriaged:

CVE-2026-15779: (postponed; to be fixed through a stable update) A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

20 ignored issues:

CVE-2021-3670: MaxQueryDuration not honoured in Samba AD DC LDAP
CVE-2022-1615: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
CVE-2023-0225: A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory.
CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVE-2023-0922: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.
CVE-2023-4154: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence.
CVE-2018-14628: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
CVE-2021-20251: A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.
CVE-2021-20316: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.
CVE-2021-44141: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
CVE-2022-32743: Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.
CVE-2022-37966: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
CVE-2022-37967: Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability
CVE-2022-42898: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVE-2022-44640: Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
CVE-2022-45141: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
CVE-2023-42669: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task.
CVE-2025-10230: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

Created: 2026-07-28 Last update: 2026-07-28 14:00

debian/patches: 1 patch with invalid metadata, 9 patches to forward upstream high

Among the 29 debian patches available in version 2:4.24.4+dfsg-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-01 08:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2:4.24.5+dfsg-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit e265ca1ad77bb839cf3ee1d97d5a279bcddc813a
Author: Michael Tokarev <mjt@tls.msk.ru>
Date:   Tue Jul 28 16:27:26 2026 +0300

    d/upstream/signing-key.asc: update

https://salsa.debian.org/api/v4/projects/samba-team%2Fsamba API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-28 Last update: 2026-07-28 14:33

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-28 14:30

lintian reports 17 warnings normal

Lintian reports 17 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-01 Last update: 2026-07-01 07:31

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

samba-vfs-modules could be converted to Architecture: all and marked Multi-Arch: foreign

Created: 2026-07-07 Last update: 2026-07-28 13:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-06-30 22:48

news

[rss feed]

[2026-07-28] Accepted samba 2:4.22.10+dfsg-0+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-07-28] Accepted samba 2:4.24.5+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-07-28] Accepted samba 2:4.24.5+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-07-21] Accepted samba 2:4.13.13+dfsg-1~deb11u8 (source) into oldoldstable-security (Markus Koschany)
[2026-07-14] Accepted samba 2:4.24.4+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-07-14] samba 2:4.24.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-07-04] Accepted samba 2:4.22.10+dfsg-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-06-30] Accepted samba 2:4.24.4+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-05-30] samba 2:4.24.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-26] Accepted samba 2:4.17.12+dfsg-0+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.22.8+dfsg-0+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.22.8+dfsg-0+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.17.12+dfsg-0+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-05-26] Accepted samba 2:4.24.3+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-05-26] Accepted samba 2:4.24.3+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-05-24] samba 2:4.24.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-23] Accepted samba 2:4.24.2+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-05-12] Accepted samba 2:4.24.2+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-04-22] samba 2:4.24.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-17] Accepted samba 2:4.24.1+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-03-18] Accepted samba 2:4.24.0+dfsg-1 (source) into experimental (Michael Tokarev)
[2026-03-15] samba 2:4.23.6+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-03-11] Accepted samba 2:4.23.6+dfsg-2~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-03-08] Accepted samba 2:4.23.6+dfsg-2 (source) into unstable (Michael Tokarev)
[2026-03-07] Accepted samba 2:4.22.8+dfsg-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Michael Tokarev)
[2026-03-01] samba 2:4.23.6+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-02-27] Accepted samba 2:4.23.6+dfsg-1 (source) into unstable (Michael Tokarev)
[2026-02-07] Accepted samba 2:4.24.0~rc2+dfsg-1 (source) into experimental (Michael Tokarev)
[2026-01-26] Accepted samba 2:4.23.5+dfsg-1~bpo13+1 (source) into stable-backports (Michael Tokarev)
[2026-01-26] samba 2:4.23.5+dfsg-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 53
RC: 0
I&N: 38
M&W: 15
F&P: 0
patch: 2

links

homepage
lintian (0, 17)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 46)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:4.23.6+dfsg-1ubuntu3
patches for 2:4.23.6+dfsg-1ubuntu3