Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowntfs-3g

Mageia: 2022-0385 Moderate: Ntfs-3g Buffer Overflow Risk

ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. (CVE-2021-46790) An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G . MGASA-2022-0385 - Updated ntfs-3g packages fix security vulnerability Publication date: 23 Oct 2022 URL: https://advisories.mageia.org/MGASA-2022-0385.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785, CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789 ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. (CVE-2021-46790) An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30783) A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. (CVE-2022-30784) A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30785) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. (CVE-2022-30786) An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30787) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. (CVE-2022-30788) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. (CVE-2022-30789) References: - https://bugs.mageia.org/show_bug.cgi?id=30479 - https://www.openwall.com/lists/oss-security/2022/05/26/1 - https://www.openwall.com/lists/oss-security/2022/05/26/2 - https://ubuntu.com/security/notices/USN-5452-1 -https://www.openwall.com/lists/oss-security/2022/06/07/4 - https://ubuntu.com/security/notices/USN-5463-1 - https://lists.debian.org/debian-security-announce/2022/msg00128.html - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/ - - https://www.cve.org/CVERecord?id=CVE-2021-46790 - https://www.cve.org/CVERecord?id=CVE-2022-30783 - https://www.cve.org/CVERecord?id=CVE-2022-30784 - https://www.cve.org/CVERecord?id=CVE-2022-30785 - https://www.cve.org/CVERecord?id=CVE-2022-30786 - https://www.cve.org/CVERecord?id=CVE-2022-30787 - https://www.cve.org/CVERecord?id=CVE-2022-30788 - https://www.cve.org/CVERecord?id=CVE-2022-30789 SRPMS: - 8/core/ntfs-3g-2021.8.22-1.1.mga8 . Recent ntfs-3g updates in Mageia rectify several security flaws linked to buffer overflows and the potential for protocol interception.. Mageia Security Update, NTFS-3G Buffer Overflow, Memory Issues. . LinuxSecurity.com Team

Oct 23, 2022 Mageia