Debian Patches
Status for ntfs-3g/1:2022.10.3-5+deb13u2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| Fix_use-after-free_in_ntfs_uppercase_mbs.patch | unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'. If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence, then 'n' will be less than 0 and the loop will terminate without storing anything in '*t'. After the loop the uppercase string's allocation is freed, however after it is freed it is unconditionally accessed through '*t', which points into the freed allocation, for the purpose of NULL- terminating the string. This leads to a use-after-free. Fixed by only NULL-terminating the string when no error has been thrown. Thanks for Jeffrey Bencteux for reporting this issue: https://github.com/tuxera/ntfs-3g/issues/84 |
Erik Larsson <erik@tuxera.com> | no | 2023-06-13 | ||
| ntfs-3g_2022.10.3-cve_2026-02.patch | acls.c: Fix heap buffer overflow in 'ntfs_build_permissions_posix'. The root cause was that the memory allocated for the ACE entries was insufficient for the worst case scenario when group entries were added for mask entries that didn't have a corresponding group entry already. Fixed by allocating space for the worst case number of ACE entries. This was reported by Andrea Bocchetti with a thorough report which made it very easy to fix. This is a backport of the original patch to version 2022.10.3. |
Erik Larsson <erik@tuxera.com> | no | 2026-02-24 | ||
| CVE-2026-42618.patch | diff --git a/libntfs-3g/compress.c b/libntfs-3g/compress.c index 390b2d97d..50d9daf32 100644 |
no | ||||
| CVE-2026-42616.patch | diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c index b8af25033..0f711815a 100644 |
no | ||||
| CVE-2026-42617_CVE-2026-46572_CVE-2026-56136.patch | diff --git a/include/ntfs-3g/index.h b/include/ntfs-3g/index.h index d001863ae..1d5845d47 100644 |
no | ||||
| CVE-2026-46569.patch | diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c index e48d6aafb..6ebaa2e4a 100644 |
no | ||||
| CVE-2026-46571.patch | diff --git a/libntfs-3g/reparse.c b/libntfs-3g/reparse.c index 76dbe2f1b..54858caa7 100644 |
no | ||||
| CVE-2026-46570.patch | diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c index e48d6aafb..4768128d2 100644 |
no | ||||
| CVE-2026-56135.patch | diff --git a/include/ntfs-3g/acls.h b/include/ntfs-3g/acls.h index 932791e97..4f36389c5 100644 |
no |
All known versions for source package 'ntfs-3g'
- 1:2026.7.7-2 (forky, sid)
- 1:2022.10.3-5+deb13u2 (trixie-proposed-updates, trixie-security)
- 1:2022.10.3-5+deb13u1 (trixie)
- 1:2022.10.3-1+deb12u3 (bookworm-security, bookworm)