UbuntuUpdates.org

Package "ntfs-3g"

Name: ntfs-3g

Description:

read/write NTFS driver for FUSE
Latest version: 1:2017.3.23-2ubuntu0.18.04.5
Release: bionic (18.04)
Level: security
Repository: main
Homepage: http://www.tuxera.com/community/ntfs-3g-advanced/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ntfs-3g"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "ntfs-3g" in Bionic

Repository Area Version
base main 1:2017.3.23-2
updates main 1:2017.3.23-2ubuntu0.18.04.5

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:2017.3.23-2ubuntu0.18.04.5 2022-11-02 14:06:24 UTC

  ntfs-3g (1:2017.3.23-2ubuntu0.18.04.5) bionic-security; urgency=medium

  * SECURITY UPDATE: code execution via incorrect validation of metadata
    - debian/patches/CVE-2022-40284-1.patch: rejected zero-sized runs in
      libntfs-3g/runlist.c.
    - debian/patches/CVE-2022-40284-2.patch: avoided merging runlists with
      no runs in libntfs-3g/runlist.c.
    - CVE-2022-40284

 -- Marc Deslauriers <email address hidden> Tue, 01 Nov 2022 07:57:16 -0400
Source diff to previous version

Version: 1:2017.3.23-2ubuntu0.18.04.4 2022-06-07 15:06:20 UTC

  ntfs-3g (1:2017.3.23-2ubuntu0.18.04.4) bionic-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in ntfsck
    - debian/patches/CVE-2021-46790.patch: properly handle error in
      ntfsprogs/ntfsck.c.
    - CVE-2021-46790
  * SECURITY UPDATE: traffic interception via incorrect return code
    - debian/patches/CVE-2022-30783.patch: return proper error code in
      libfuse-lite/mount.c, src/ntfs-3g_common.c, src/ntfs-3g_common.h.
    - CVE-2022-30783
  * SECURITY UPDATE: heap exhaustion via invalid NTFS image
    - debian/patches/CVE-2022-30784.patch: Avoid allocating and reading an
      attribute beyond its full size in libntfs-3g/attrib.c.
    - CVE-2022-30784
  * SECURITY UPDATE: arbitrary memory access via fuse
    - debian/patches/CVE-2022-30785_30787.patch: check directory offset in
      libfuse-lite/fuse.c.
    - CVE-2022-30785
    - CVE-2022-30787
  * SECURITY UPDATE: heap overflow via ntfs attribute names
    - debian/patches/CVE-2022-30786-1.patch: make sure there is no null
      character in an attribute name in libntfs-3g/attrib.c.
    - debian/patches/CVE-2022-30786-2.patch: make sure there is no null
      character in an attribute name in libntfs-3g/attrib.c.
    - CVE-2022-30786
  * SECURITY UPDATE: heap buffer overflow via crafted NTFS image
    - debian/patches/CVE-2022-30788-1.patch: use a default usn when the
      former one cannot be retrieved in libntfs-3g/mft.c.
    - debian/patches/CVE-2022-30788-2.patch: fix operation on little endian
      data in libntfs-3g/mft.c.
    - CVE-2022-30788
  * SECURITY UPDATE: heap buffer overflow via crafted NTFS image
    - debian/patches/CVE-2022-30789.patch: make sure the client log data
      does not overflow from restart page in libntfs-3g/logfile.c.
    - CVE-2022-30789

 -- Marc Deslauriers <email address hidden> Mon, 06 Jun 2022 14:11:22 -0400
Source diff to previous version
CVE-2021-46790 ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecat
CVE-2022-30783 An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 202
CVE-2022-30784 A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
CVE-2022-30785 A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through
CVE-2022-30787 An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
CVE-2022-30786 A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
CVE-2022-30788 A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
CVE-2022-30789 A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.

Version: 1:2017.3.23-2ubuntu0.18.04.3 2021-08-31 18:06:20 UTC

  ntfs-3g (1:2017.3.23-2ubuntu0.18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: multiple security issues
    - debian/patches/aug2021-security.patch: backport fixes from new
      upstream version.
    - No CVE number

 -- Marc Deslauriers <email address hidden> Mon, 23 Aug 2021 09:25:29 -0400
Source diff to previous version

Version: 1:2017.3.23-2ubuntu0.18.04.2 2019-04-17 16:06:27 UTC

  ntfs-3g (1:2017.3.23-2ubuntu0.18.04.2) bionic-security; urgency=medium

  * Fix LP: #1821250 - Don't install /bin/ntfs-3g as setuid root. If
    administrators want to allow unprivileged users to be able to mount NTFS
    images, they can restore this functionality by changing the permissions of
    /bin/ntfs-3g with dpkg-statoverride
    - update debian/ntfs-3g.postinst

 -- Chris Coulson <email address hidden> Thu, 21 Mar 2019 21:33:01 +0000
Source diff to previous version
1821250 Drop setuid bit from /bin/ntfs-3g

Version: 1:2017.3.23-2ubuntu0.18.04.1 2019-03-21 18:06:28 UTC

  ntfs-3g (1:2017.3.23-2ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in /bin/ntfs-3g
    - debian/patches/0001-Fixed-reporting-an-error-when-failed-to-build-the-mo.patch:
      Fixed reporting an error when failed to build the mountpoint
    - CVE-2019-9755

 -- Chris Coulson <email address hidden> Thu, 14 Mar 2019 14:21:40 +0000
CVE-2019-9755 RESERVED


About   -   Send Feedback to @ubuntu_updates