The vulnerability of the `ntfsattr_setup_flag` function in the NTFS file system driver for the FUSE NTFS-3G module involves insecure privilege management. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the ntfsattrsetupflag function in the NTFS file system driver for the FUSE NTFS-3G module is related to insecure privilege management. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

Updated ntfs-3g packages fix security vulnerability

Security vulnerabilities were identified in the open source NTFS-3G and NTFSPROGS software. These vulnerabilities may allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to potentially execute arbitrary privileged code, if the attacker has either local acce...

MGASA-2022-0001 Updated ntfs-3g packages fix security vulnerability

Security vulnerabilities were identified in the open source NTFS-3G and NTFSPROGS software. These vulnerabilities may allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to potentially execute arbitrary privileged code, if the attacker has either local acce...

Huawei EulerOS: Security Advisory for ntfs-3g (EulerOS-SA-2021-2807)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : ntfs-3g (EulerOS-SA-2021-2807)

According to the versions of the ntfs-3g packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In NTFS-3G versions 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfsgetattributevalue, a heap buffer overflo...

A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.

...

NTFS-3G versions < 2021.8.22 when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag a heap buffer overflow can occur allowing for code execution and escalation of privileges.

...

In NTFS-3G versions < 2021.8.22 when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.

...

A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.

...

A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite) causing stack consumption in NTFS-3G < 2021.8.22.

...

A crafted NTFS image can cause an integer overflow in memmove leading to a heap-based buffer overflow in the function ntfs_attr_record_resize in NTFS-3G < 2021.8.22.

...

Debian: Security Advisory (DLA-2819-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2819-1 : ntfs-3g - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2819 advisory. - In NTFS-3G versions 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfsgetattributevalue, a heap buffer overflow can occur allowi...

[SECURITY] [DLA 2819-1] ntfs-3g security update

Debian LTS Advisory DLA-2819-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 16, 2021 https://wiki.debian.org/LTS Package : ntfs-3g Version : 1:2016.2.22AR.1+dfsg-1+deb9u2 CVE ID : CVE-2021-33285 CVE-2021-33286 CVE-2021-33287 CVE-2021-33289 CVE-2021-352...

DLA-2819-1 ntfs-3g - security update

Bulletin has no description...

Fedora: Security Advisory for ntfs-3g (FEDORA-2021-5b1dac797b)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2021:3704)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3704 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

RHEL 8 : virt:av and virt-devel:av (RHSA-2021:3703)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3703 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes

The ntfs3g package is susceptible to a heap overflow on crafted input. When processing NTFS attributes, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open()

The ntfs3g package is susceptible to an input validation attack. When processing a crafted NTFS image there is an improper check. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...