# ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3: ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3 for Ubuntu 18.04.6 LTS (bionic)

ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3, released September 7, 2021, fixes 21 CVEs in ntfs-3g. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-ntfs-3g-1-2017.3.23-2ubuntu0.18.04.3
- Platform: Linux
- Released: Sep 7, 2021
- Priority: High (Closes CVE-2021-35267, high severity)
- CVEs: 21, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [ntfs-3g](https://patchblox.com/security/data/product/linux/ntfs-3g.md) | Ubuntu 18.04.6 LTS (bionic) | 1:2017.3.23-2ubuntu0.18.04.3 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2021-33289](https://patchblox.com/security/data/cve/CVE-2021-33289.md) | High | hivex: ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section | 7.8 | 0.0049 |  |
| [CVE-2021-35266](https://patchblox.com/security/data/cve/CVE-2021-35266.md) | High | libguestfs-bash-completion: ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname | 7.8 | 0.0049 |  |
| [CVE-2021-35267](https://patchblox.com/security/data/cve/CVE-2021-35267.md) | High | libguestfs-bash-completion: ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections | 7.8 | 0.0049 |  |
| [CVE-2021-35269](https://patchblox.com/security/data/cve/CVE-2021-35269.md) | High | libvirt-daemon-driver-interface: ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT | 7.8 | 0.0048 |  |
| [CVE-2021-35268](https://patchblox.com/security/data/cve/CVE-2021-35268.md) | High | libiscsi-devel: ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode | 7.8 | 0.0047 |  |
| [CVE-2021-33286](https://patchblox.com/security/data/cve/CVE-2021-33286.md) | High | libvirt: ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string | 7.8 | 0.0046 |  |
| [CVE-2021-39256](https://patchblox.com/security/data/cve/CVE-2021-39256.md) | High | libvirt-daemon: ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() | 7.8 | 0.0044 |  |
| [CVE-2021-39254](https://patchblox.com/security/data/cve/CVE-2021-39254.md) | High | libguestfs-bash-completion: ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() | 7.8 | 0.0044 |  |
| [CVE-2021-39261](https://patchblox.com/security/data/cve/CVE-2021-39261.md) | High | netcf: ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() | 7.8 | 0.0043 |  |
| [CVE-2021-39263](https://patchblox.com/security/data/cve/CVE-2021-39263.md) | High | libvirt-daemon-config-nwfilter: ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute | 7.8 | 0.0043 |  |
| [CVE-2021-39252](https://patchblox.com/security/data/cve/CVE-2021-39252.md) | High | libvirt-daemon-driver-storage-rbd: ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() | 7.8 | 0.0043 |  |
| [CVE-2021-39253](https://patchblox.com/security/data/cve/CVE-2021-39253.md) | High | libguestfs-tools-c: ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() | 7.8 | 0.0042 |  |
| [CVE-2021-39260](https://patchblox.com/security/data/cve/CVE-2021-39260.md) | High | swtpm-libs: ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() | 7.8 | 0.0042 |  |
| [CVE-2021-39262](https://patchblox.com/security/data/cve/CVE-2021-39262.md) | High | libguestfs-bash-completion: ntfs-3g: Out-of-bounds access in ntfs_decompress() | 7.8 | 0.0042 |  |
| [CVE-2021-39251](https://patchblox.com/security/data/cve/CVE-2021-39251.md) | High | libvirt-daemon-driver-nwfilter: ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() | 7.8 | 0.0042 |  |
| [CVE-2021-33285](https://patchblox.com/security/data/cve/CVE-2021-33285.md) | High | libvirt-daemon-driver-qemu: ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value... | 7.8 | 0.0042 |  |
| [CVE-2021-33287](https://patchblox.com/security/data/cve/CVE-2021-33287.md) | High | hivex: ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes | 7.8 | 0.0041 |  |
| [CVE-2021-39255](https://patchblox.com/security/data/cve/CVE-2021-39255.md) | High | libguestfs-inspect-icons: ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute | 7.8 | 0.0040 |  |
| [CVE-2021-39258](https://patchblox.com/security/data/cve/CVE-2021-39258.md) | High | libguestfs-tools: ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() | 7.8 | 0.0040 |  |
| [CVE-2021-39259](https://patchblox.com/security/data/cve/CVE-2021-39259.md) | High | libguestfs: ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length | 7.8 | 0.0040 |  |
| [CVE-2021-39257](https://patchblox.com/security/data/cve/CVE-2021-39257.md) | High | libguestfs-tools-c: ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap | 7.8 | 0.0038 |  |

---

Data as of 2026-11-13T14:02:24Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.