Samba 4.0.25 Available for Download

                   Release Notes for Samba 4.0.25
                          February 23, 2015

This is a security release in order to address CVE-2015-0240 (Unexpected
code execution in smbd).

o  CVE-2015-0240:
   All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
   unexpected code execution vulnerability in the smbd file server

   A malicious client could send packets that may set up the stack in
   such a way that the freeing of memory in a subsequent anonymous
   netlogon packet could allow execution of arbitrary code. This code
   would execute with root privileges.

Changes since 4.0.24:

o   Jeremy Allison <>
    * BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer
      in netlogon server could lead to security vulnerability.

o   Andreas Schneider <>
    * BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference
      a NULL pointer./auth: Make sure that creds_out is initialized with NULL.