o CVE-2010-0728:
In Samba releases 3.5.0, 3.4.6 and 3.3.11, new code
was added to fix a problem with Linux asynchronous IO handling.
This code introduced a bad security flaw on Linux platforms if the
binaries were built on Linux platforms with libcap support.
The flaw caused all smbd processes to inherit CAP_DAC_OVERRIDE
capabilities, allowing all file system access to be allowed
even when permissions should have denied access.
Changes since 3.3.10
--------------------
o Jeremy Allison <jra@samba.org>
* BUG 6557: Fix vfs_full_audit.
* BUG 7036: Fix 'net rpc getsid' in hardened Windows environments.
* BUG 7045: Fix bad (non memory copying) interfaces in smbc_setXXXX calls.
* BUG 7067: Fix failing of smbd to respond to a read or a write caused by
Linux asynchronous IO (aio).
* BUG 7072: Fix unlocking of accounts from ldap.
* BUG 7104: "wide links" and "unix extensions" are incompatible.
* BUG 7122: Fix reading of large browselist.
* BUG 7154: "mangling method = hash" can crash storing a name containing
a '.'.
* BUG 7155: Valgrind Conditional jump or move depends on uninitialised
value(s) error when "mangling method = hash".
o Gunther Deschner <gd@samba.org>
* BUG 7043: Fix crash bug in "SMBC_parse_path".
o Volker Lendecke <vl@samba.org>
* BUG 5626: Fix build on AIX.
* BUG 5885: Fix bogus ip address in SWAT.
* BUG 7046: Fix a crash in libsmbclient used against the OpenSolaris CIFS
server.
o Stefan Metzmacher <metze@samba.org>
* BUG 7098: Fix results of 'smbclient -L' with a large browse list.
* BUG 7170: Fix handling of external domains in setups with one way trusts.
o William Jojo <w.jojo@hvcc.edu>
* BUG 7052: Fix DFS on AIX (maybe others).
o Bo Yang <boyang@samba.org>
* BUG 7106: Fix malformed require_membership_of_sid.
This isn't latest release, but diffrence from current package is minimal
supported release.
Since changes are too huge to write here, please refer each release notes:
http://www.samba.org/samba/history/
And this pacakge already contain fix for CVE-2009-3297.
