Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases
These are security releases in order to address CVE-2020-27840 (Heap corruption via crafted DN strings) and CVE-2021-20277 (Out of bounds read in AD DC LDAP server).
Please ignore the 4.14.1, 4.13.6 and 4.12.13 releases and only use 4.14.2, 4.13.7 and 4.12.14.
If you are building/using ldb from a system library, you'll also need the related updated ldb tarball, otherwise you can ignore it.
The uncompressed Samba tarballs have been signed using GnuPG (ID AA99442FB680B620).
The uncompressed ldb tarballs have been signed using GnuPG (ID 4793916113084025).
The Samba 4.14.2 source code can be downloaded here. Incremental patches for Samba are also available: patch from Samba 4.14.0 to 4.14.1 and patch from Samba 4.14.1 to 4.14.2 See the 4.14.2 release notes for more info. The ldb 2.3.0 release for use with Samba 4.14.2 can be downloaded here.
The Samba 4.13.7 source code can be downloaded here. Incremental patches for Samba are also available: patch from Samba 4.13.5 to 4.13.6 and patch from Samba 4.13.6 to 4.13.7 See the 4.13.7 release notes for more info. The ldb 2.2.1 release for use with Samba 4.13.7 can be downloaded here.
The Samba 4.12.14 source code can be downloaded here. Incremental patches for Samba are also available: patch from Samba 4.12.12 to 4.12.13 and patch from Samba 4.12.13 to 4.12.14 See the 4.12.14 release notes for more info. The ldb 2.1.5 release for use with Samba 4.12.14 can be downloaded here.