Summary
USN-5463-1 fixed vulnerabilities in NTFS-3G. This update provides the
corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Roman Fiedler discovered that NTFS-3G incorrectly handled certain return
codes. A local attacker could possibly use this issue to intercept
protocol traffic between FUSE and the kernel. (CVE-2022-30783)
It was discovered that NTFS-3G incorrectly handled certain NTFS disk
images. If a user or automated system were tricked into mounting a
specially crafted disk image, a remote attacker could use this issue to
cause a denial of service, or possibly execute arbitrary code.
(CVE-2022-30784, CVE-2022-30786, CVE-2022-30788, CVE-2022-30789)
Roman Fiedler discovered that NTFS-3G incorrectly handled certain file
handles. A local attacker could possibly use this issue to read and write
arbitrary memory. (CVE-2022-30785, CVE-2022-30787)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | ntfs-3g | 1:2013.1.13AR.1-2ubuntu2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ntfs-3g | 1:2015.3.14AR.1-1ubuntu0.3+esm3 |
Vulnerabilities 7
-
Medium 6.7
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
-
Medium 6.7
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
-
Unscored —
An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the…
-
Unscored —
A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write …
-
Unscored —
An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when usi…
References
-
report
https://ubuntu.com/security/CVE-2022-30783
-
report
https://ubuntu.com/security/CVE-2022-30784
-
report
https://ubuntu.com/security/CVE-2022-30785
-
report
https://ubuntu.com/security/CVE-2022-30786
-
report
https://ubuntu.com/security/CVE-2022-30787
-
report
https://ubuntu.com/security/CVE-2022-30788
-
report
https://ubuntu.com/security/CVE-2022-30789