<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="100">
<package pkgid="06a17a27fb725984cad6819a173e225fc4d14aebce21fef0f602fe31b943580eab5c070f90ba8a318c9d1d58fec02a00e50ef6d0e84d68fcab91a9e0bde27b02" name="ctdb" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="48a2fe401d1c726ef73e18f3abfb65b5ce516ad329a8c400eb23acb9f2cae6ab09f83b73d8983a3bb51980874e4c48b63309d58f3a9d9643ec05485a21362907" name="ctdb" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="a5c68be69a259a32d589a9eadb6c124d1a0cee7a75591e5f6d965278ff2c4c594656857a63311689182ed0586f30e0b770804dc78281cbfe7537618ae1242674" name="ctdb-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="64dc0c10fa891f6c363ce8009c9a64b133500f8b44dc3c355c87b871f975947c151e1485a655da311b5a1c771fe508a3e637fb8eb2ead0d18f4aea4194232509" name="ctdb-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="0ce2b77431da70167535841097dc2b59b33011a9992ae20d3442b14e83db6ea06eae3865c9ccdb816f8dba46ce705fad344cce05f462c6343b509ebfa29c9f66" name="ctdb-pcp-pmda" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="144e0e9b65ab660c3deafe8ac62b572c62b31591ba2e63cc87b99ad3d29260c5b1bc3cbab7fdef51953851b541fc72b681ac4f9fd12ba23191f7057af669bf35" name="ctdb-pcp-pmda" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e2038b7ef99fd9c896c2100f2075c3b5cf178e969e479aed23f915e5964f084310a114a5a394c3745a36d5f05efc38f26747ed27b3fa3529763da937571d0758" name="ctdb-pcp-pmda-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2baddede34191aedbaf36c71e1c36005393ff4695417f670c71752b6762ab0a880ea529562a55c3706745c0f984774c16f6b2812bebf7eb0f661dc0b718e3186" name="ctdb-pcp-pmda-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="073bb28a82a6c31814b591f8fcdb7fd7dfca0c4754fbe36493a646cca3f0d134cdefad50cf262e7451db077de31ea4b4919ac8e87f1ec81b7baae5eca9277970" name="ldb-tools" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f3f95dde9d9b8e001cb5308819b499b9292ecfd5155b199ffdec8fac2963fa0f33e8b084195530408427354bb4151b07f798e82b1264b8525fac99ded9d0e58b" name="ldb-tools" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c6bf2879ad4dcd2ac6a203f3266bb2e2f451558d8f2684f2c6d7af8ed166aaae686a44192099850a4e17c1752d3d81d66043d0ec8d1ca7aa5cdd2327187b84e1" name="ldb-tools-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="bcde476ce556f9c58473039f2d696820b39dac4cc74825b4c4462d24b2bed9fa9002ec3babd5ad26b71fb32b3301bccf48c1433932f530956898d11f950b2371" name="ldb-tools-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="3ac9ba2aa03517920c39c034fc069338c2ed47e721debfeaf8f72f0b60920a668519ac8a5f61ececfdc98b500848bc3ed00cea5224a9c09708e9d5c17bda2c82" name="libldb-devel" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="bf5902b44e3a2732e11a6f3ad21d18e6ccf522256251d857275e3d0648e05e63d2d9e385c4f0f391708211c54a86c90c2a553664c6b024f9ce829b301ebe3149" name="libldb-devel" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="92538cf3a17b1afb683905fd9913f131240bde01170903e71b9f2c146afefb10cd629b4179600af2b0adb765fbfc395c998ea0e411e5cdd9b002c6833559f5ef" name="libldb2" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="5dff61869d7e1789bc0b158ac7889d72152b17d388d6809c15080d3cd8678a57583179fa65bc38c162b9605d5716173f345b1d70b1bf8505fe7bfa8e359d59f6" name="libldb2" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="cab8b767d81b017a6bfb8a549bdbd37f73276b35d5d3f61c80c909fece75fc3a97c0fce652c62e6ec502853736b1d787dc9d419aa643882f01a08f9413a2f224" name="libldb2-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="9e3f6d49759def1fdd14b9902b0b578d5ea5de9892d70932d430fb32ee5fb6c93c1bdce53f59643bce51078391337f050ea61f670a9ed603bd3363119d72e5df" name="libldb2-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e043904df079b59dc8cb11bc84580cbd021e4e113af5620588c498ccaa44e5ea1cc542becda7af34ef4b93180a639e0bbe98c496435a3fe3954ae016e87b2d98" name="python3-ldb" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="81113bcc7eeb3592a45b8722449c24df88120ef1e0fe5363ba4c76071d375ee6497ee4e4594356582f024d652985e77b3b3ca99edd729633414e4e90e44bb0b9" name="python3-ldb" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="294935b38ffe4bd522e3c2be4b1a9ea0f3c5d38539d3b7b99d80c590221c0e66ee1af8b9dd64dee3a4ac069e289f5d25d1cef96266a9397ec34a9a623c9b459a" name="python3-ldb-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="ebc2dc4d6e14c788026d952b65534273a7048bc8c94d8b4c938fc02469c05b78041c4655f8f1df18e475888e2e25a0e1f723dba3e850c12bee24fe69c7f152e2" name="python3-ldb-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="91e084880ba138b5d6c6c1bc7830aa63241f449110d1278afc8da564a3ba7cff47aa2c3cb9efa81c81b46e062977e1ed6de2495b9853a6f15ac436128bc60eb1" name="realmd" arch="aarch64">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="65c049aa589d762f68032ee23cc6d9782277637c519f0959c04724bb1060cf0c022b818b1271da579eecff135b8382d24fb862df1766244f0d014eda06c283e1" name="realmd" arch="armv7hl">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="fb6b495910b47acd9bfac67632f9fee609d1f7137ca8ae8547d80dfe64e305f99894cf5aec367608ab2040aed4782419bd018f55f04f67e90e0901ef7b2ac9b2" name="realmd" arch="src">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="jmcdonough@suse.com" date="1368619200">- Check in 0.14.1</changelog>
  <changelog author="jmcdonough@suse.com" date="1368705600">- Add docs and cleanup some build warnings</changelog>
  <changelog author="kkaempf@suse.com" date="1395748800">- Upgrade to 0.14.5
  Bugfix release</changelog>
  <changelog author="kkaempf@suse.com" date="1423396800">- update to 0.15.2
  * Bugfix release
  * systemd support
  * automake 1.14 support</changelog>
  <changelog author="kkaempf@suse.com" date="1429704000">- update to 0.16.0
  * Disable automatic AD joins unless explicitly configured to
    do so. This guarantees that mutual trust is established with
    a domain that you are joining.
  * Validate textual data discovered via LDAP before using them
    in configuration files like samba.conf and sssd.conf</changelog>
  <changelog author="darin@darins.net" date="1463745600">- update to 0.16.2
  * Be more liberal with domain name chars
  * Increase timeout when calling PackageKit
  * List package names with spaces between them [#89464]
  * Install to $prefix/lib instead of $libdir
  + 0.16.1
  * libsystemd build fix [#90519]
  * Change default home directory to /home/%U@%D
  * Add --automatic-id-mapping=no command line argument
  + 0.16.0
  * Disable automatic AD joins by default [#89205]
  * Validate text we receive from LDAP
  * Prefer adcli for AD joins
  * Remove hard dependency on PackageKit
  * Fix crash when empty password is used with realm client</changelog>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="9e2c995139a8c9216f1db67b0584f0388777934e93aed3c19f6b0da03fdcc84def4995bbdfac3857b68341520c14a3e894fb148be91bbb903c1bc1ed3242414f" name="realmd-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="31a8ddca288c5da1699707bcafe5457475f8d20300adff3b6cd301fa7e504731d2bb92ddbb4d8ff1d4e70ae174894a3e2b4b6f56883e86ecba08de1054181dca" name="realmd-debuginfo" arch="armv7hl">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="f97b8e8797326d9244eb3fa49265a7738a489881a6d508a9c547ef0b4290d925abc981a24a2dfc6d4a24827379e6a0eaaf0e53009240bc93dc2e2303d5023f3d" name="realmd-debugsource" arch="aarch64">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="063a34c569cbbee32cbcf1d1a0739ec23c891c7102b3436ace45542fda0f030476b64da09f7cce0620a5df7e124972557ee0e02ffb78302573565286fd48d970" name="realmd-debugsource" arch="armv7hl">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="7ae17a1ad875e330a366ed269648f4993c14b2c0899fea9de5d01a69e7167062232f2472557b19943c07733545370a6623702541b5f9865843060559bf015289" name="realmd-lang" arch="noarch">
  <version epoch="0" ver="0.17.1" rel="28.5"/>
  <changelog author="plinnell@suse.com" date="1481889600">- update to 0.16.3
- some minor package tweaks
- Add rpmlint filter for polkit error - A temp fix until security
  review is completed.</changelog>
  <changelog author="plinnell@opensuse.org" date="1500465600">- https://bugzilla.suse.com/show_bug.cgi?id=916766
  and https://bugzilla.suse.com/show_bug.cgi?id=1048025 resolved.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1579694400">- Adjust BuildRequires to allow OBS to shortcut through -mini
  flavors:
  + systemd -&gt; pkgconfig(systemd)
  + krb5-devel -&gt; pkgconfig(krb5)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1592222400">- Use proper unitdir macro to specify location of systemd units.</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1600948800">- Adjust pam-config arguments for openSUSE; (bsc#1176053);
  + Add 0001-suse-pam-settings.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620388800">- Update to version 0.17
  + Use current idmap options for smb.conf
  + Find NetBIOS name in keytab while leaving
  + Work properly with Python 3
  + discover: try to get domain name from hostname
  + Set 'NEWEST' flag when resolving packages with PackageKit
  + service: use "kerberos method" "secrets and keytab"
  + Use startTLS with FreeIPA
  + service: use 'additional dns hostnames' with net ads join
  + Fix pam misconfiguration for SUSE systems
  + Kerberos: add default_domain and udp_preference_limit
  + tools: add --use-ldaps option for discover, join and leave
  + Fix nsswitch handling when joining and leaving domain for
    suse distro
  + paths: install realmd in libexecdir
  + tools: enforce absolute path for install option
- Drop upstream fixed 0001-suse-pam-settings.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- update to 0.17.1:
  * Kerberos: use fewer attributes for g_file_query_info() [gfo#36]
  * service: use name instead of IP address with ad_server [rhbz#2129050]
  * tools: add --do-not-touch-config option for AD [gfo#30]
  * Use autoreconf and gettext
  * samba: use new Samba-4.15 command line options [rhbz#2028530]
  * syslog: avoid duplicate log messages [rhbz#2024248]
  * ldap: add socket timeout [rhbz#1817869]
  * Use target arch pkg-config to fix cross compilation [gfo#35]
  * doc: add computer-name to realm man page
  * configure: update some macros for autoconf-2.71
  * build: add --with-vendor-error-message configure option [rhbz#1889386]
  * distro: use authselect on Red Hat platforms</changelog>
  <changelog author="FroggyFlox &lt;flox2b@gmail.com&gt;" date="1681473600">- Adjust BuildRequires to enable detection of samba-cli version
  during configure:
  + samba-client</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1730980800">- UsrEtc fixes, create parent directory for sssd.conf; (bsc#1232921);
  Add 0001-Create-parent-directory-for-sssd.conf-if-not-exists.patch
- Require sssd-ad and copy nsswitch.conf from /usr/etc prior
  modification; (bsc#1232931); Add
  0002-Update-OpenSUSE-configuration.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1736510400">- Remove unnecessary build dependency libpackagekit-glib2-devel</changelog>
</package>
<package pkgid="12b7bbb699478ccf105ea51f47889f84921d8ee25af187c270a0c41edfda39dd31d10f14ef173e11b351df8238131742e23cd94aeb228b2f0d3df7b037245f3a" name="samba" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="3c0bfa35518e8d0d17ebd38a5c37b1d9e95bb499de4098aaba0714632dec98cd9f09fa243bdfb156aa8387cb6027187356e63153d2fe6231edf3402dd21b74ad" name="samba" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="188c08e6a429c45d1c9ce1aff98428c8864c7f44c2c886f4c7f5b202378f349a8923900df5a8bbc725561498b267d0d5e30dc86cca140776d93c14d23f25d63b" name="samba" arch="src">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f65147b7a103d7cfcbcdf869ada7a90f8f718cd70c155ba836478d7b990a844f540cbecb5968cb008b349fc6bd6265b803a380a216cb8df4db53ef4da41e9e6e" name="samba-ad-dc" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2d53414387f9ecd0fdef1c04b298e5f587228ca10b36922fef46a1fcbf3d1acb9e2a415a3024455b1164dd89bdb257a55998b54e97ea7ad2cefd20889856ffa9" name="samba-ad-dc" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="807583dcc74409933ac8fe6296c1f8155990b7a2ab244dff3d95e53e7af2a88bbe464d416a1118eba8d9cb52713a711033e73e0924f2f88f32e2d2e489a13c97" name="samba-ad-dc-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e05354024cde3b2f63dbcac02e8257a14ba7a5e2abef3b9774ccc1f94f0a42c22a3d5759ee5fe4574c0897602e3e98c48029f2a74e94510e0f0499c26c7b7a1d" name="samba-ad-dc-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="4096f9af1bc859606eef78db39e8e68251f2733f950cbcb7ced9739d1031f7abc37f447e1eeeb7eaceaf3a4fe4780216743b6538c776c3e731bec882f099655b" name="samba-ad-dc-libs" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="bce400b52de0a6644bd064657625c2e8cbe24ff8e3427a76310ed3e04995dc9b0a80460ecf04f42ef82acd047d1a94e54d0487fdd6cbdfe29f9c3074e9306371" name="samba-ad-dc-libs" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="e70dc8e3a33120d8be2f064df1e0d2e38d53013d03edf2eb479961947569abacc0b1b83c48685788bc10945ed29e10a448acc6ec3ad0bf333f2da772018c5a8c" name="samba-ad-dc-libs-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c0958e97631b6fb574a5d423bc6d6085c63e0dbc6a6696c1bd2b8ee297911ab9d8db8687a5acc1a44fc46e06e9028dbb3debaac3295d90e57b7001862f3abd89" name="samba-ad-dc-libs-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="727f463430068efce833999b16a596265fa72883d1d5c836497534905cfa61e046a5c62fa91b5a7c8d76ee4526b0651dab71df6c14407852c5eae7fc52f8cd96" name="samba-ceph" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="b728c29d4077e59a8f919a1eb8522dbe06ad54cbe7b22e7c09c7c0645c9f8651dbe185f41778b42045cd7c2f16eddca34e7fb883f4b8b4d5f5fd205fd9a266a7" name="samba-ceph-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f6b5c9d39417f2f73036390f0f75ed5fa1d6d8d36f968d46bc1c760f3b2ffb64380359745b8274f2757058f35511e51efcb3661fb21b4ddfb23bd101cec2a1e0" name="samba-client" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="ea0e3c710bd4e9b2d82ffd45716bd31ef2d981275a9a71e7d031f975a2583672d57f0663daa65adc67086a0c0ceca95d71536abd9815caf26f6200972d578bd7" name="samba-client" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="b7d53fa98f1f3897bae60711e542b58ec22ff005ad997d5a2e75f57dee6c400a09a4438294ee96f7ec7f8bd4bcdeaabd97adbbb8be3d97a79375b5cd7fa915d0" name="samba-client-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="dabd26ec55e37097c3ae53d7b74604374f5f87f28335a4840aa6aaf7dfd531f45f5438eee995fae28127bc8ed0be176b53c7ffe23121abf4741c515d86e5b51f" name="samba-client-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="0e01b5a18e3551f9c78b1837f91c954746fc874bee2d234ea84b5cccc82dc4dd7b64708901dd315e458aef003fe4f155580397a742135ad74aa23ed16581a6df" name="samba-client-lang" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="354ea0096e2fd7c23c78d98eff1a1a44b3d2471a299e6185d6db8969a9213dd4eec8e2a7f4d4593e238699f6e6c47a62888ebc44eb0a7ae9502ec8a62d971e9c" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="3fa69916a6cbdc357d65a2ded240be61942133ff791369c0e6f728ab7c03c2193303329822008122643c7bd11dbf5fb7903544ecb2fee68396ae288542b4e627" name="samba-client-libs" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="0ca73b4e84cd91a887e6909190f5cb3140300bb50aa1a185752a2325d52446bf99a8a789b1776829a7882cdea8fd4f2660736cdf9cb636109b41320b6fb07551" name="samba-client-libs-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c666f37e4738a9a245a2938da8fc3ce07a019cc97bac2a571d7d57ba457189daa6e514cf28002295cb10d735a62c0eff15f8be507e0c8e37d36ce5214a195213" name="samba-client-libs-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c2b52f88fb7d04f5e29c1c4bd803835b9d193c674d8ae94aa17d89970a64aeb75197d66a68c31a990e7f384688f6d9d3171fb9b9278462ee9a35bbc19162666d" name="samba-dcerpc" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="4c16631b613f74adb6c992abd2593c215b447a63ac1dc0b7b514c770b6d9d71d11ad67376c10002d8f928f72b19378f83defb829d4bd0578e5db13f879b9a72a" name="samba-dcerpc" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="a2ffcd62a8f11ee337ac886cc45bc22b055b615d6306f1bbbee91a98a90f01b27517a7187dcd44e240674f379ffb7c085bbf736026a2a8d3e89cce9f298d7eca" name="samba-dcerpc-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="98961f23300ecca71f46331f4f8348a955c2ca6e581007629cb2c143c3149c94ab7bd5fdfa8f8386e0c18eee247e4b4da2d4137a6f1172175560ccc9dcbe4819" name="samba-dcerpc-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="19c02018dd61b95c874e5b626e37583a29a1d7771cedb646d1c2efc56825fd3bc20be3fc740c81faa23f96f8b6e08796f2077b208c10ca9748705b4107ec2af1" name="samba-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f0531f5c65c343b86d679f920916f6bf07df65ba7f29dadcbb9c03887ae6b73803d03e126b2cdcde08322c5a6d3eb6c677ae048875ee633a2758b825afe8f2e6" name="samba-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f4b3ec5f267fa136c68261e4ed82cd26bf8887b6624d76a875d7a4361704a9679a98f7bc97bfcc67327205ecac760ae9672762a89aa6255a666b75cdf7610136" name="samba-debugsource" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="d27026ccc98c929521cc77ad72c3226a319c1b28ca29869f5aa1252c8ce33e0cd0dda549c5bae98bd62ae91423215b5c9f2eeb1d03d0524037141249e299dd0e" name="samba-debugsource" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c46a285c91bc81511473c59cccdbe8b2dddd5af5466e8f99a9a1c0931c9c2efbbe9da4a714a5e250edfa77145f6da0003757f0d7f1b2a9f5aa48ea393a8dfe20" name="samba-devel" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="9294ccb25a2cc23427dd0696e6e265a4885fc2bec83c56f160616d031c1c3e0efdb5511aada9bc1dd44d733dbc49ffe76500514d7a4a2fe6126b2eadff2951a6" name="samba-devel" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="1b6cc2f24591036ccb88eec60dce352ed0f8e4748033ef65b0c006b30954ef665c84a430068b5ea5d153b27e6011888a1fbd31eaefcc5c543bf5a989f68c5518" name="samba-doc" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="8037975bb6519cc80eb11fcc747ebf2a5415dfe70660d90f22ef1fb3f2f361b42528d4b603e63795924564ee3dfc31f089a87f92a0cd52403fb621776026c050" name="samba-dsdb-modules" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="71b74baeff68ead26ba9c1bfa6d9f2445410978c5d4e30ff7465c3e067f53e099c311032203bb838fc7fd8c5c9bc3faa6e25555f69effca94618d2281c59dab3" name="samba-dsdb-modules" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="f6dcffa28206bdc788d39f1ef5a5e6f304d43fdd69204f7bd3031a612a1ff3aa9742a4a3a924f3aacfe56cd8d6633922a2d120cbec6efd79f31324d274161ea5" name="samba-dsdb-modules-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="ffa2a94815b488fa6b13dcab7c41972dcc3b6080e410108ee2f77c08585b88214357a04188fc41bf3e76540b7edca2c6d54a5f9e39a31a2a54a8cf1bd4a3cea3" name="samba-dsdb-modules-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="499b4b69a34ce09a4d77cacb7d51012a46e01c25a4cb0039fa19c69a573e9d6998536a5994c966aa0b275a9715717c07837c01010efd38a3fb5c943b75ffcc18" name="samba-gpupdate" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="ed26084d76fd766e647049109333342e119a6361dd1eeaae72fe2a4d8ecf6963f7479cd3a1268a4d61cc2db3773fc3869d3e554639303b52bfcf6af072849f8c" name="samba-gpupdate" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="388e4aa8c065b10cb359a0258dcd2029067412604e7cd770661f29804c9509549c768fd2cf88bb8ac2ee0258edc8ea50ef84ee4d8371e4d3a5f4925c1bc3ca5e" name="samba-ldb-ldap" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="fc9670dd3f349e6ef1ff588269c997a144bba83f65366e817c6162ef9465b920ff0bf3ca87a6dbca52d192bcde8f5012d2409c0680e10db21fd05469a469b3d5" name="samba-ldb-ldap" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="0c7f7de9b0c3a3b754ed13dbc58cd16a83976aba11991ec69609619aef190fcbb8890cf3ade08597bcf20c175c4926419bfe102030d7d22bc97bb6b56fc41325" name="samba-ldb-ldap-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2132bc83dcb435dd8abc3bd0309b6fca55db07d0eb3dbab727954ecbada7c205408734ced1b9a695bb160d601178758e5b65804602270f22d6aaa12fd99a1400" name="samba-ldb-ldap-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="21b44e911ce483a2e5793efd6539854947961923a7f01629f103143bf93f421907a79728e39d6f0261b304cab8ae27fcfc0369a4aa044bd2718a537f36c13eef" name="samba-libs" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="24e03c199be24274b9ceea2eabbb5be93e6bab80a85a1fc794dc427515b73cf117a2faff377ceb044c73807b6453d737b5b3c4369fc78d2deaeee4fbdb119ab7" name="samba-libs" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="8c40b8b621432f17f292eef89ed1aaa15746c5c7d1b4f8e8d621b2aacbba295feeb5c4d85358edc0f32fbf9850e08f41c45689b3f63563127ffe1487fa1d422b" name="samba-libs-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="a2714331b065bef749a42d314b0af99197a69ee168fe2f0aa27bd8b09baa8a9a6b6276cc5462c3c0aee9c7554aa02d567161b952b092127fb467c88e60e6553d" name="samba-libs-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="aa023d48334350dbce10b911dce2e815fcad73e769830d7a38dc0748732a9605d9956c062c5300d73650db197f1fe2ea69128a67586fa4a29e3cc3ab77829c55" name="samba-libs-python3" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="905bbaa253f99a1ee10e971b4405a858cb7533cac86160bff66bb2b528a6f1d98a9883d4e6ac33648cb995db9d6b85b65760defa4b913ac0bc42e505ed7af4bf" name="samba-libs-python3" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2ab4d65f73aa3b5bfc9a46f2e2437372c7ba8e99b6b79053885543d4c6e8fb16075c3062df5e6eade1a11561338eddabe58d6b55ec09fe0b27a177ff688bb7a2" name="samba-libs-python3-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="5ef3569aa5859413707071f4b1c7cd65bab50782af03d4d8026ad183f87829ab238032503ec01861e2144f515f6fc3a48af4a677dba5c2992aceab9be8b228cb" name="samba-libs-python3-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="46ba61e8846eb024d2ff96cbd79ce864ed0620ecec62169b0d46bba98bebb365ec3f19ffd75885c6ac69f2dc7fc21d3a98f60f8da9f5e686328a311cbe4f62a0" name="samba-python3" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="60c7daab68626fea6ead71136fa35df91868316ee2fc56337591c2ca93eb9e79b0e43f2a18e4a9d51b8c57da3b2fa3da6343b013548236039b472ca59f27cb0c" name="samba-python3" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="b791f8b651bcf9e5fe650d82662f238fe82686a6c22254c82cd228c37c44aa097f7413ee94628300a9ca82cae1a056b184526e3b9813e49edd5b2da1d469ee5a" name="samba-python3-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="78bcc147ab0e7433ae5c6f126e77217ef30ca158ca1636400063c0cb3dcea334593e661cc337c7a703a9e7f26a5ea2c13d63a0b0b32eba536d0c657329af5f4e" name="samba-python3-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="514f0762a6ec284eadfcaf09722d4aec57a07f474891428d5b0c194f290c316a469c2b9984651bccdee62aadce614796d4309b44b780322e32dd9737fd3e2684" name="samba-test" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="b61a0e66a8bd73abb16ab5bb8da8ec58579650bab2cdf0ca3791baab0dd88e840a8e49d83d97ccc9383dee14ad2c82dd9158a0560be57b281d66551bc69d6d2e" name="samba-test" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7c5279c649c7f0481f55b88b5f14c04834e362d33a406979a698fe7f71f7f6b752e72c4d5bd052bd61cdad9734a36db9909a08f6cf2c137292dff8d1a40d8210" name="samba-test-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7ff7d952c9d9f05525b40c397e501e4adf0c8a9defd99a69d1ee821a44bc8a57ded0afe9d8699144da368e0174ec6dcd6a47992e6f97aeb3d97ef769e6500ca9" name="samba-test-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7c9aa8c33808c5480e157d2cbf500e9926b60c4b6de472b56a16b49b440e52944608a1ebacbdf900d88405d08dcfebcd565649724cc421593d8da631cd469c2f" name="samba-tool" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="cfe97907d31d94010f4c1ce7dd7121e72df6265b4fe77ea724a5554fcb999041dc3766fd325e553433a3e01bd99348d6aff6a0f3350ec61fa27b629f8371d8ae" name="samba-tool" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="8a8c25e4144872192f4e3144e76c352862cd38ed93cf849fcc91480024e463214192b6e4333248ce1439bbfd744d3da6096dc6faf940dabd5c60656c09dd642d" name="samba-winbind" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="87c1bd96426803f033eaf51ae9825f3b042ae9400db5591069cd49a362f59ae9c24f66c332e3e0221ceeff59a01954658c0b3b4dc734945a8afe86862a5a22c0" name="samba-winbind" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="aabbfc22238c3f79759b45ae8b2e6d3dd3e982a145f5aff79130ab3b092867f240fa950a19a18a3ebdccdd4b58598bb1a4bd3b77b5727b52b15640b5cf14ea52" name="samba-winbind-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="d5c9b25f60b377d93f4ba8c86767a9a80e2ab5c648056e2c402752109a81e229537992852c2cd6231e902e229ea9f6ca355e1ba8364932d80a24d692044fbeec" name="samba-winbind-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="7fc0cbb50dea5cda0d1b4b5b5af26460393fa96584609d4e0114343323f43e3d3edaea8f90bbe4311f99e76ec7054080258ba92dbe45ea99dfc9d08c770d4ca4" name="samba-winbind-libs" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="2b471641add6918cc2551b2eec8cf76010ff68f84b5f9e158fc87ab1f4ea58e38e812d45fecc94e31be23cfce9d90d41604494c28507d01c9aeb5a4bc1168da5" name="samba-winbind-libs" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="1246f4e0c2e2e175796bcbc51a8ad1285357a07d7ad945848ee6b8dad089888dcf9e62f08355ab7970eec383e04f4af5c017e0e30033724a6543c06013891f02" name="samba-winbind-libs-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="73674936b1de4f966d489d923d9b45e10c9648514d8bf316a8e9600bca5ceabd89b3618dfcfdde033af53af58e50459645b539c3d05b4bdcdc28f99313cb80f5" name="samba-winbind-libs-debuginfo" arch="armv7hl">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
<package pkgid="c1ba88ddc8db1332ca929d9e3d2e91f27e6d338614f1038e661a5785cca41fb31a102cf24d31ba1f27237ce37b85261f714e813ddb479b584a3e53bd61ca670d" name="samba-winbind-libs-lang" arch="noarch">
  <version epoch="0" ver="4.24.3+git.475.629de6765b9" rel="2.21"/>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801600">- Ensure semanage is pulled in as a requirement when samba in
  installed when selinux security access mechanism that is used;
  (bsc#1249180).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1758801601">- Disable timeouts for smb.service so that possibly slow running
  ExecStartPre script 'update-samba-security-profile' doesn't
  cause service start to fail due to timeouts;(bsc#1249181).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1759320000">- Relax samba-gpupdate requirement for cepces, certmonger, and sscep
  to a recommends. They are only required if utilizing certificate
  auto enrollment (bsc#1249087).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1760529600">- Update to 4.22.5
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1761048000">- Update to 4.22.6
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1761912000">- Update [printers] location to /var/samba/spool; (bsc#1249179).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765281600">- Update to 4.23.4
  * Samba 4.22 breaks Time Machine; (bso#15926).
  * mdssvc doesn't support $time.iso dates before 1970;
    (bso#15947).
  * Fix winbind cache consistency; (bso#15963).
  * Assert failed: (dirfd != -1) || (smb_fname-&gt;base_name[0] ==
    '/') in vfswrap_openat; (bso#15897).
  * ctdb can crash with inconsistent cluster lock configuration;
    (bso#15950).
  * samba-bgqd: rework man page; (bso#15809).
  * samba-bgqd can't find [printers] share; (bso#15936).
  * Winbind can hang forever in gssapi if there are network
    issues; (bso#15955).
  * libldb requires linking libreplace on Linux; (bso#15961).
- Update to 4.23.3
  * Spotlight search restriction for shares incomplete and
    default search searches in too many attributes; (bso#15927).
  * Searching for numbers doesn't work with Spotlight;
    (bso#15930).
  * rpcd_mdssvc may crash because name mangling is not
    initialized; (bso#15931).
  * Only increment lease epoch if a lease was granted;
    (bso#15933).
  * vfs_recycle does not update mtime; (bso#15940).
  * samba-log-parser fails with UnicodeDecodeError: 'utf-8' codec
    can't decode byte; (bso#15943).
  * Crash in ctdbd on failed updateip; (bso#15935).
- Update to 4.23.2
  * CVE-2025-10230: Command injection via WINS server hook
    script (bso#15903); (bsc#1251280).
  * CVE-2025-9640: uninitialized memory disclosure via
    vfs_streams_xattr; (bso#15885); (bsc#1251279).
- Update to 4.23.1
  * Incomplete bind configuration causes DLZ plugin to crash;
    (bso#15920).
  * winbind can crash at startup; (bso#15914).
  * vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev
    for fsync_send; (bso#15919).
  * CTDB does not support PCP 7.0.0; (bso#15904).
  * CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set;
    (bso#15921).
- Update to 4.23.0
  * samba.tests.safe_tarfile fails on Python 3.13 with additional
    security fixes for tarfile support; (bso#15911).
  * samba-4.21 fails to join AD when multiple DCs are returned;
    (bso#15905).
  * Uninitialized read leads to hanging rpcd_spoolss;
    (bso#15908).
  * Stack buffer overflow in samba3.smb2.dirlease.fileserver;
    (bso#15907).
  * Regression in gssproxy support in 4.23.rc1+; (bso#15902).
  * 'net ads group' failed to list domain groups; (bso#15900).
  * macOS Finder client DFS broken on 4.22.0; (bso#15843).
  * Self-signed certificates don't have X509v3 Subject
    Alternative Name for DNS; (bso#15899).
  * Improve handling of principals and realms in client tools;
    (bso#15893).
  * libquic build fixes; (bso#15896).
  * getpwuid does not shift to new DC when current DC is down;
    (bso#15844).
  * Windows security hardening locks out schannel'ed netlogon dc
    calls like netr_DsRGetDCName; (bso#15876).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765540800">- samba-ad-dc-libs packages are missing a DLZ plugin for bind 9.20;
  (bso#15790); (bsc#1249058).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1765972800">-  Fix Samba printers reporting invalid sid during print jobs;
  (bsc#1234210); (bsc#1254926); (bso#15792).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1766059200">- Adjust README.SUSE to reflect the new preferred location for
  '[printers]' share; (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1766404800">- Remove cron package recommends; (bsc#1255450);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1768996800">- Fix mistake in README.SUSE /var/spool/samba =&gt; /var/samba/spool
  (bsc#1254665).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1770033600">- Update to 4.23.5
  * New Spotlight default search field incorrectly initialized;
    (bso#15959);
  * Winbind group resolution failure; (bso#15972);
  * winbindd crashes with Bad talloc magic value - unknown value;
    (bso#15937);
  * Bind dlz 9.20; (bso#15790); (bsc#1249058);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1771416000">- The "include system krb5 conf" option searchs for
  /usr/etc/krb5.conf if /etc/krb5.conf does not exist;
  (bsc#1257940);</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1773835200">- Update to 4.23.6
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * possible memory leak  on rpc_spoolss; (bso#15979); (bsc#1257200).
  * "net offlinejoin requestodj" manpage entry incorrectly
    mentiones provided credentials; (bso#15964).
  * "use-kerberos=desired" broken; (bso#15789); (bso#1255755).
  * pthreadpool_tevent has race conditions accessing both
    pthreadpool_tevent.jobs list and
    pthreadpool_tevent.glue_list; (bso#15958).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * ctdbd socket documentation is wrong; (bso#15977).</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1774872000">- Use multiple threads for SELinux relabeling in
  update-samba-security-profile (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1776168000">- Add support to allow default selinux autolabelling by
  update-samba-security-profile on service [re]start to be
  inhibited; (bsc#1259050).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1777291200">- Update to 4.23.7
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * libsmbclient posix extensions with SMB3 don't work at all;
    (bso#15960).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).</changelog>
  <changelog author="Noel Power &lt;noel.power@suse.com&gt;" date="1779796800">- Update to 4.23.8
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1779883200">- Update to 4.24.3
  * CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
    (bso#16033); (bsc#1261161).
  * CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
    (bsc#1261163).
  * CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
    nbt server; (bso#16012); (bsc#1261160).
  * CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
    enrollment using http:// without validation;(bso#16003);
    (bsc#1261159).
  * CVE-2026-1933: Fix missing access check on reparse point
    operations; (bso#15992); (bsc#1261188).
  * CVE-2026-2340: vfs_worm does not block directory modification;
    (bso#15997); (bsc#1261158).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059).
- Update to 4.24.2
  * Samba 4.24 with cups can't get queue and shows errors about
    fetch_share_cache_time; (bso#16038).
  * Fix a directory file descriptor leak in vfs_glusterfs that
    caused unbounded memory growth on the GlusterFS brick with
    persistent SMB2 connections; (bso#16043).
  * Windows Offline Files fails with permission error when
    directory has the read‑only attribute set; (bso#16030).
  * samba not triggering mount of zfs snapshot in dataset
    .zfs/snapshots/&lt;snapname&gt; directory; (bso#15991).
  * net ads join still fails with multiple DCs; (bso#15999).
  * samba-tool shows wrong format specifiers for timestamp
    attributes; (bso#16076).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * smbpasswd can crash winbindd on an AD DC; (bso#15973).
  * smbd does not cleanup on disconnect of the transport
    connection on lease break errors; (bso#15995).
  * CVE-2026-40170: thirdparty ngtcp2 needs to be updated;
    (bso#16059); (bsc#1262273); (bsc#1262337).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * Winbind can change Ownership Of / To A User Who has Homedir /
    In passwd; (bso#16073).
  * Winbind lsa_OpenPolicy() fails on lsa connection setup with:
    NT_STATUS_RPC_CANNOT_SUPPORT; (bso#15987).
  * CTDB read-only record handling contains use after free and
    resource leak bugs; (bso#16068).
- Update to 4.24.1
  * autobuild fails if /proc/version contains trailing space;
    (bso#16057).
  * use after free in streams_xattr_connect(); (bso#16035).
  * rpc workers with long living clients grow server  memory
    keytab; (bso#16042); (bsc#1257200).
  * vfs_snapper failing to access or enumerate files in
    subfolders; (bso#16058); (bsc#1259667).
  * Samba is not build with FORTIFY_SOURCE; (bso#16040).
  * Fix tests with MIT Kerberos 1.22.x; (bso#16055).
- Update to 4.24.0
  * incorrect behavior on rpcclient enumport with rpcd_spoolss;
    (bso#16019).
  * altSecurityIdentities X509 issuer DN order is reversed;
    (bso#16001).
  * vfs_aio_ratelimit: introduce burst-aware and persistent state
    model; (bso#16000).
  * No function _python_sysroot defined; (bso#15990).
  * leases torture test flappy; (bso#15978).
  * smbd: in contend_dirleases() don't bother checking when not
    enabled; (bso#15984).
  * 'net ads kerberos kinit' should use also default ccache name
    from krb5.conf; (bso#15993).
  * "use-kerberos=desired" broken; (bso#15789).
  * source3/libads/kerberos.c sets wrong failure for negative
    connection cache; (bso#15975);  (bso#1255755).
  * CTDB's statd_callout fails on sm-notify; (bso#15938).
  * CTDB statd_callout_notify notifies unnecessary clients and
    loses their state; (bso#15939).
  * Backport domain default AES encryption types to 4.24;
    (bso#15998).
  * possible memory leak on rpc_spoolss; (bso#15979);
    (bsc#1257200).
  * Winbind group resolution failure; (bso#15972).
  * ctdbd socket documentation is wrong; (bso#15977).
  * time_t related build failure on 32bit arch in 4.24.0rc1;
    (bso#15976).</changelog>
</package>
</otherdata>