This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-16852 →

DEBIAN-CVE-2018-16852

Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS manage...

Original description

The description as published by the source.

Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.2+dfsg-2"}]}]

Debian:13 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.2+dfsg-2"}]}]

Debian:14 samba

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.2+dfsg-2"}]}]

References

advisory security-tracker.debian.org