<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="52">
<package pkgid="5b9956e8c029d79a1935978901deabb17d53b9996e230c2b9e1bfc64b9b3094e744768bffe04818ae8433bee717c94f291e0c886abc1fef8ad5254d107c8f5aa" name="ctdb" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="25d0d5b2cd26466f72e44f9fbb18df922289fdcbde39515a61e5b3737c7e7cc1cb8ecc9fe95d1b8edde4c9a722824a40318ad66b28b6dc237d8f4b5cb07faf79" name="ctdb-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="7b71ee344c0e9a7fef644514225c04850d76aca561c4d0e8567cf531eb840c7be23879153cb04ffbabcdb3e8c37e41fc869e476bedc3a06f40b25283ee0eca97" name="ctdb-pcp-pmda" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="4d063c170e017f009e983f122ed4996bf434ef99b71ef9ecccff5f4bb0a232d15e987b5e030c1f1e9891342c6158872fbb294f05e9c9feeed942e4881784b8f9" name="ctdb-pcp-pmda-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="7ba933c847f63cb698ee2b59398ef5cce1144bb52108085009904e5ecb837aebda627c9e5624a893d7f60a34e1a39ba2d4e7393459047ef2662f3e5b6ab50922" name="ldb-tools" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="0dcfa75467bc4a6d397374b3086ed1a01a5322f3fe8103b9d24663c20a3f5df85ff43a4e698087944f775d2998ea0309a0bb32e4823fb2c135a453c71de73be6" name="ldb-tools-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="fe47d4e25ccd6fbf751ec3f52a935e75f29e560d75561752c7ec9f05d228ef7b99d44baf1dfc77c2bc8628c9a035bc45019c0bf4fb943cf871e6933307237d7f" name="libldb-devel" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="9427cb4962588bf1410a0761ba4e78b322fb38609ca763eae7572b92fc516c9d15ef5c105552a18d0558250d7278042ad16bae9d0c67ccc20bd7a916ee95f2ef" name="libldb2" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="653cca5d381041e8b4c9e0b1048067ed305fa201028a4c0fa880647c487e302367fd05a3d513ec76706afdedbd85063d90dc1e9da452cd819adfd5c2f5cce0e0" name="libldb2-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="25548e7c27878f320f31a68d90154188db2e70481e229af3384a8a7bb2e891fd8bf687ede6104ed6e41b8d1b9fb48531c845fd3acbad4b7791e3baa13e687a33" name="python3-ldb" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="7f9ab8c06e6a35c04ac86cf08562180b72bb41de923725fdc91fc38a8576c53ca6d1ce61b8767eb9548cd1a88d2c33aeb6b05d9593bb818f140e6dbe214ee37a" name="python3-ldb-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="8ac880b653f0bd4888a9d8c595664561ddb984014ea1e9394e2e981208faf7629c42339aa16a5d5e789cf2a161689c86320c6fa474ceaefb12abed664ecd4179" name="realmd" arch="ppc64le">
  <version epoch="0" ver="0.17.1" rel="28.7"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="bb4f79a8dcac3e253e359805f095270282284f4a9a769e064c1a87010ace2ee2e0f13a6ff33a40a16e9d611be3f2505c05465b196e99ebee9f20ce82c7441586" name="realmd" arch="src">
  <version epoch="0" ver="0.17.1" rel="28.7"/>
  <changelog author="jmcdonough@suse.com" date="1368619200">- Check in 0.14.1</changelog>
  <changelog author="jmcdonough@suse.com" date="1368705600">- Add docs and cleanup some build warnings</changelog>
  <changelog author="kkaempf@suse.com" date="1395748800">- Upgrade to 0.14.5
  Bugfix release</changelog>
  <changelog author="kkaempf@suse.com" date="1423396800">- update to 0.15.2
  * Bugfix release
  * systemd support
  * automake 1.14 support</changelog>
  <changelog author="kkaempf@suse.com" date="1429704000">- update to 0.16.0
  * Disable automatic AD joins unless explicitly configured to
    do so. This guarantees that mutual trust is established with
    a domain that you are joining.
  * Validate textual data discovered via LDAP before using them
    in configuration files like samba.conf and sssd.conf</changelog>
  <changelog author="darin@darins.net" date="1463745600">- update to 0.16.2
  * Be more liberal with domain name chars
  * Increase timeout when calling PackageKit
  * List package names with spaces between them [#89464]
  * Install to $prefix/lib instead of $libdir
  + 0.16.1
  * libsystemd build fix [#90519]
  * Change default home directory to /home/%U@%D
  * Add --automatic-id-mapping=no command line argument
  + 0.16.0
  * Disable automatic AD joins by default [#89205]
  * Validate text we receive from LDAP
  * Prefer adcli for AD joins
  * Remove hard dependency on PackageKit
  * Fix crash when empty password is used with realm client</changelog>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="dce34bd3ecf796fdf7a54db0e6f7ef7527583e4efe3c53a52de33b093df311944c0d6e596546c2a6b45d838d9428955ac1ca8a27976431d9fe216036415de102" name="realmd-debuginfo" arch="ppc64le">
  <version epoch="0" ver="0.17.1" rel="28.7"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="750d1f13e892decb2007bd5df53477cda28c72f7c73a210da81447d611b4b19b8c89579e7f0a05657d364603bdc733b7bdd30aa0a1df7a6e1b3f3e2037ecce5a" name="realmd-debugsource" arch="ppc64le">
  <version epoch="0" ver="0.17.1" rel="28.7"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="82db8af271a01ebaee928a50b79cbdafe77850495f67d7cebf345a03906b745199e8ab53ef7fbae3720e971ba90d2fb5e68f78f50b2fd06a1b26028ec664465d" name="realmd-lang" arch="noarch">
  <version epoch="0" ver="0.17.1" rel="28.7"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="641fabc01e02718dad47febd99a7d30f3c1d3599ee887e26a6c1daaef7983eb1e55fa31cac69d95ea3e3a38428772cc2306582a21f57989d92880bbebf108ee6" name="samba" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="3cc56d6b1a97d7aa8b3f98fe153fa0007a93d4f678a2b47f7b20b694b56c6620b09e4771e1fd6e54248d7847786405e6864acd6a66607b9b2cf399d52e98cfd8" name="samba" arch="src">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="154cc183845eedf302557b5f65561964c9ce157a5c64de2cd8e278e6cf86f9cc8c33e0b0991dee455837818dbdac48c8cd0592da7a6a29ff2defef4db42b90ea" name="samba-ad-dc" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="b7c924146e6ad1fb4fed61ef995eaafdebfff2b56600799d20cb2a32feebaec0eb0e0aef3b53ed37891181370c01ca101069c603f843996dafea48d6e7b9352f" name="samba-ad-dc-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="0f7ace0e6f0242d3b470aa5236affe2abe03592e298f02e4dbda38d46c86cb74c239758837ed50c31760a7db379e425eba8d443672b042bc24067238a8e2b924" name="samba-ad-dc-libs" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="74d6b3ef96d85f33a43dd74bd61edc39025421d8559865797dfca4972f30b84a1d9af47e6f0d0579200a273fc08ab3ea805ef69c5fffc502c69f24abcec6ba06" name="samba-ad-dc-libs-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="5a8f9ed624943f7388d7b358fd1a85bb1ba40ea6890d1896bcd8a1b8cc91e30acff839a7acbed67c0eef31ac182419ab00f98078e00d37fc50105ebf89a9792e" name="samba-client" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="fcf5142c6da30f888b85cea307f8d18d0d418a2978c320fa7487226d34ece3fb42ec6270bbe5ac6504b7a05918995ee9cb936a6aacd146e1d047d1a16520e4dd" name="samba-client-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="fad31f7bd7e54ce1772e577b3a00743b044dcf317293112086de3811ab8f8d13ada8052413cab8c0169d4c7fe3d04e5d1734a4f46ee36e0ad4ee68bf89d83341" name="samba-client-lang" arch="noarch">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="8fa1caa483d8012df427f745ad14ae4015eab46d1459b8eba5c972b895ab98d7c2b55dab52b45cf58c4b1e5666d2964eee921913b4a1dae05fb99eb1cd4e7fc6" name="samba-client-libs" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="debef4ac53b153af0a0ac64bc436688e946dae13289bd4d4b49bcf61953873a612a1daf66aa4080d1db4b803bbbec519200584fb2c69d503a0785406f389e466" name="samba-client-libs-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="de5a55603e844abb9c6f6f92e1b4f8150cb3e4ba406d86609c1a3086f23f9ae89ae2ae92324c168e3e9d37fc04592d15206cb505e59289c8d06c05fd303ccbe2" name="samba-dcerpc" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="c34181aac86a0c7588f988c49c9c834152f03e414f039c231ff1367e325f5232f748114424f2e273b020c4f83ef43cbd7a9aa65b0714a38c45a248c491863729" name="samba-dcerpc-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="4e64ff06145869fdd7e1844724705b41b4cb9680c73dcd29c41b9a7b655d0a0fe8cbcf886b6c70d7f121a0ab5d95abb6f2d40fb8b0c13d011558c9849a4c553c" name="samba-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="cc0956ba8e55ce4b20402c258b4f4404d49a8319d0fe43250c93d8dcc9495efb989a3fccfdb2c3a837362cce959d391483eb4f30324ad0bfc6dd7d66f306ce40" name="samba-debugsource" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="48f2e7db61759290c685b2112d4df70649084a3e12136d22f1f83aa4658c2b639af74871464b75c88737b870f3fdab2eef32c2651629e000deed37f656e003c2" name="samba-devel" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="9c8f85cec77ea0d249b6c2146bfb0106d67227f89b0743de3ace2abb7f0e8e0a88761c45ea20ebc9be66e6e053b816ea51c8f2502a7fcb00d41b0b15988d0408" name="samba-doc" arch="noarch">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="a26644c29b3e6471a77c7d896059438549eebfd9e5ae05d2d8fd369ee37244ee5777cdc3710ecc039d4e0a028795b6104e3642799d3ab58dbef1728766bfa1a4" name="samba-dsdb-modules" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="e0344aa439f36ece2f40b6f1b4b6238f9255ee09c9247d414e9fa8581972b7628d628cd651fa1af72b102900b6e69547ae27c4ce881f9c1a0ccb81c9272c00e5" name="samba-dsdb-modules-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="ed429f56f58cb663ab63e70b5fe77de01be599237baca5aeae7f1ece0594564853bb597e214fc57f2c6f09533f0dcbe399b785fbc533c13e164313d2e918baff" name="samba-gpupdate" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="52798e7eb5d1dc203f6ca7c49b0a512607506706067114d0d9cf86749be4f8ce4510eaa5cfff5db25a6df8ac85b06b3d113622e2de7929d7e668871580c5cfaf" name="samba-ldb-ldap" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="c2afd6d0262c4198950490ad4037242c3e4f4b0a45d19182a4d4b44189222c00af8e435b1e77530b3734c75b9d4368e5a6bd5c70ae65106283867af90dc520a3" name="samba-ldb-ldap-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="bc7efb054dc03a1229010f971ce795c3ff8c9453c84919ae34b6a2cf916b7ba28fcad4ca8caac9ffa4b95460433faab1b99f01aaee7dad6dedff4d61c2688368" name="samba-libs" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="80ac6f8c781bcc9b7584849395efb3b93f675fe199890a9af103f9e5f6bd89861fad9e1a596e455238ef9c8dcc9da08b2a031b45cd6c6ff979d5e5e0e854615d" name="samba-libs-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="075ea7d84cb07636d559b385504654158febdb9ec835c8d1b0b7748a88352e9b3aa06f1ec9e9d37a5b2e81d1f222c706077f4d66a08b7053f6fb3bfbb1eb649a" name="samba-libs-python3" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="7fb57f2df58c3af5d7b6fc44533815355ec972b9a85ecb6a063876d35244727f71ac8adcf5af9797cb1359466017dc88cb86b88700e42664ab17c009a1e4f4b6" name="samba-libs-python3-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="35df27f8b561a67d9d1779de344e3d2d3f352eaa610fd255e099095fc7d162612edde0b9823edd3341fadd7ff9c5c1bdd5e178dec1d0c94608bf28f8a0d3538e" name="samba-python3" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="6ee2ff3e152b5af14e08b424f419b4f11a3dda8f527363fc553e4f734efe75820363c670e5ffbebda1331603463637bbf713185b813f22b622b6d766fa173ac8" name="samba-python3-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="618794fd63b28a1b9d48b6567435b2ea3ace4dc19bad9cda867b08b72b84f9bbf13d4437dc607af0f25534edfd13a86c8c567e0f135df15e460a8f0a0fb91c29" name="samba-test" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="4eebf25d6c39ff3379f008f0a19376e56565d9d18899697adcce8cabcbe421c1a209df020888b178387cd43256db77ed5185db7d32efbc590283a5e52f5cf54e" name="samba-test-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="9f628ea813a0c42995fbf6f2083cb6e0df242c55573c035e4d5c042dc3af7da8721b5f6bb6e6002ac9f077c0b83d0357ef0a5f4ad67ded3d2d5439e3ad2def47" name="samba-tool" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="0576b21980da2bb25043ad668c98dad8e82353bd300ecd0fc7248efc9fce78e20f4785b27713ceaafa10a0c66dbfd669d5a2da4b89f857de86b0596506f9be2f" name="samba-winbind" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="c0446858a16f4b8b3d31fb140ad156605ecc3f56adc7d5cc8e83f53da3e5becc076cf9518716faedc22f51824a66f796556a1a7156f1384930a1241404450598" name="samba-winbind-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="90d6232b339b733c0b50cab22cb7f2954c9434f9789f56b3faf6ca876103831afeed0f0116efddf23340d344f54d6d256c976abd2b29a832aac7f1b61f919711" name="samba-winbind-libs" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="cada6c2f231e7e1e1da3a6d6165202ac38538f833caecde9847ca86d8fb4d8c1c851d15de8a3f30c37e9d00f85366a1858a7999511815ccf18da0b3d76703563" name="samba-winbind-libs-debuginfo" arch="ppc64le">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
<package pkgid="7b6666c82ea348d366260c758f372f9a921238977914dfec57ab1011f82fc6fde36a404974dfb073a961af04e73740601abe2c416031cb95dfc53890fd88a73b" name="samba-winbind-libs-lang" arch="noarch">
  <version epoch="0" ver="4.24.5+git.481.dba78dbdea" rel="2.12"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1782907200">- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1785240000">- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).</changelog>
</package>
</otherdata>