Dear samba maintainers, the fix for CVE-2018-1050 (eg from 4.5.12+dfsg-2+deb9u) applies cleanly on 3.6.6-6+deb7u15, however CVE-2018-1050 says that only versions >4.0.0 are affected. Since (afaics) there is no known exploit I cannot really test this, but I believe 3.6.6-6+deb7u15 is also vulnerable and the ">4.0.0" is only claimed to be non-affected because the samba developers don't support < 4.0.0 anymore. Is that the case? What's your recommendation what should be done here? To me it seems we should fix 3.6.6 in oldoldstable and then also notify others that <4.0.0 is vulnerable, but I have no idea how to best communicate the latter. Comments much appreciated. -- cheers, Holger
Attachment:
signature.asc
Description: PGP signature