Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package yast2-samba-client for openSUSE:Factory checked in at 2026-09-11 19:00:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/yast2-samba-client (Old) and /work/SRC/openSUSE:Factory/.yast2-samba-client.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "yast2-samba-client" Fri Sep 11 19:00:11 2026 rev:121 rq:1376869 version:5.0.5 Changes: -------- --- /work/SRC/openSUSE:Factory/yast2-samba-client/yast2-samba-client.changes 2026-03-27 06:53:38.196191259 +0100 +++ /work/SRC/openSUSE:Factory/.yast2-samba-client.new.1265/yast2-samba-client.changes 2026-09-11 19:00:37.965871599 +0200 @@ -1,0 +2,8 @@ +Wed Aug 5 15:35:08 UTC 2026 - Noel Power <[email protected]> + +- CVE-2026-25706: yast2-samba-client: OS command injection via + attacker-controlled OU (Active Directory-supplied); + (bsc#1272776). +- 5.0.5 + +------------------------------------------------------------------- Old: ---- yast2-samba-client-5.0.4.tar.bz2 New: ---- yast2-samba-client-5.0.5.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ yast2-samba-client.spec ++++++ --- /var/tmp/diff_new_pack.BbrZLd/_old 2026-09-11 19:00:39.312927738 +0200 +++ /var/tmp/diff_new_pack.BbrZLd/_new 2026-09-11 19:00:39.314927821 +0200 @@ -17,7 +17,7 @@ Name: yast2-samba-client -Version: 5.0.4 +Version: 5.0.5 Release: 0 Summary: YaST2 - Samba Client Configuration License: GPL-2.0-only ++++++ yast2-samba-client-5.0.4.tar.bz2 -> yast2-samba-client-5.0.5.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-samba-client-5.0.4/package/yast2-samba-client.changes new/yast2-samba-client-5.0.5/package/yast2-samba-client.changes --- old/yast2-samba-client-5.0.4/package/yast2-samba-client.changes 2026-03-25 18:37:00.000000000 +0100 +++ new/yast2-samba-client-5.0.5/package/yast2-samba-client.changes 2026-09-10 11:05:55.000000000 +0200 @@ -1,4 +1,12 @@ ------------------------------------------------------------------- +Wed Aug 5 15:35:08 UTC 2026 - Noel Power <[email protected]> + +- CVE-2026-25706: yast2-samba-client: OS command injection via + attacker-controlled OU (Active Directory-supplied); + (bsc#1272776). +- 5.0.5 + +------------------------------------------------------------------- Tue Mar 10 09:00:28 UTC 2026 - Michal Filka <[email protected]> - jsc#PED-14507 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-samba-client-5.0.4/package/yast2-samba-client.spec new/yast2-samba-client-5.0.5/package/yast2-samba-client.spec --- old/yast2-samba-client-5.0.4/package/yast2-samba-client.spec 2026-03-25 18:37:00.000000000 +0100 +++ new/yast2-samba-client-5.0.5/package/yast2-samba-client.spec 2026-09-10 11:05:55.000000000 +0200 @@ -17,7 +17,7 @@ Name: yast2-samba-client -Version: 5.0.4 +Version: 5.0.5 Release: 0 Summary: YaST2 - Samba Client Configuration License: GPL-2.0-only diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-samba-client-5.0.4/src/modules/SambaNetJoin.pm new/yast2-samba-client-5.0.5/src/modules/SambaNetJoin.pm --- old/yast2-samba-client-5.0.4/src/modules/SambaNetJoin.pm 2026-03-25 18:37:00.000000000 +0100 +++ new/yast2-samba-client-5.0.5/src/modules/SambaNetJoin.pm 2026-09-10 11:05:55.000000000 +0200 @@ -335,7 +335,7 @@ $machine =~ s/dc=([^,]*)//gi; # remove DC=* parts $machine =~ s/([^,]*)=//gi; # leave only values from the rest my $m = join ('/', reverse (split (/,/,$machine))); - $cmd = $cmd. " createcomputer=\"$m\"" if $m; + $cmd = $cmd. " createcomputer='" . String->Quote($m) . "'" if $m; } my $result = SCR->Execute(".target.bash_output", $cmd);
