PT-2025-42317 · Samba+6 · Samba+6

Published 2025-10-15 · Updated 2025-11-26 · CVE-2025-9640

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description An issue exists in Samba’s vfs streams xattr module where uninitialized heap memory can be written into alternate data streams. This can allow an authenticated user to read residual memory content, potentially including sensitive data, leading to information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-908

Related Identifiers

ALT-PU-2025-13456

ALT-PU-2025-13458

AZL-68817

AZL-68936

BDU:2025-15225

CVE-2025-9640

DLA-4384-1

ECHO-BC79-1DDE-0065

OESA-2025-2509

OESA-2025-2510

OESA-2025-2511

OESA-2025-2512

OESA-2025-2513

OESA-2025-2539

OPENSUSE-SU-2025:15649-1

OPENSUSE-SU-2025:20048-1

SUSE-SU-2025:03603-1

SUSE-SU-2025:03604-1

SUSE-SU-2025:03612-1

SUSE-SU-2025:03618-1

SUSE-SU-2025:21005-1

SUSE-SU-2025:21026-1

SUSE-SU-2025:3676-1

SUSE-SU-2025:3677-1

USN-7826-1

USN-7826-2

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Samba

Suse

Ubuntu

References · 74

• https://osv.dev/vulnerability/openSUSE-SU-2025:20048-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2539 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9640 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68936 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3677-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10230 · Security Note
• https://ubuntu.com/security/notices/USN-7826-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15225 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3676-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-9640 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2512 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2513 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03612-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9640 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-68817 · Vendor Advisory