ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3: ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3 for Ubuntu 18.04.6 LTS (bionic)

ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3, released September 7, 2021, fixes 21 CVEs in ntfs-3g. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.

HighUnsupported product

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

7.8

Base score, 0 to 10

Highest EPSS

0.0049

42nd percentile

Priority of the 21 CVEs

Patch now 0
                                Urgent 0
                                High 21
                                Routine 0

Fixed package versions

Product	Release	Fixed in
ntfs-3g	Ubuntu 18.04.6 LTS (bionic)	1:2017.3.23-2ubuntu0.18.04.3

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2021-33289	hivex: ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section	7.8	0.0049	None reported
High	CVE-2021-35266	libguestfs-bash-completion: ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname	7.8	0.0049	None reported
High	CVE-2021-35267	libguestfs-bash-completion: ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections	7.8	0.0049	None reported
High	CVE-2021-35269	libvirt-daemon-driver-interface: ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT	7.8	0.0048	None reported
High	CVE-2021-35268	libiscsi-devel: ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode	7.8	0.0047	None reported
High	CVE-2021-33286	libvirt: ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string	7.8	0.0046	None reported
High	CVE-2021-39256	libvirt-daemon: ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name()	7.8	0.0044	None reported
High	CVE-2021-39254	libguestfs-bash-completion: ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize()	7.8	0.0044	None reported
High	CVE-2021-39261	netcf: ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite()	7.8	0.0043	None reported
High	CVE-2021-39263	libvirt-daemon-config-nwfilter: ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute	7.8	0.0043	None reported
High	CVE-2021-39252	libvirt-daemon-driver-storage-rbd: ntfs-3g: Out-of-bounds read in ntfs_ie_lookup()	7.8	0.0043	None reported
High	CVE-2021-39253	libguestfs-tools-c: ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i()	7.8	0.0042	None reported
High	CVE-2021-39260	swtpm-libs: ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information()	7.8	0.0042	None reported
High	CVE-2021-39262	libguestfs-bash-completion: ntfs-3g: Out-of-bounds access in ntfs_decompress()	7.8	0.0042	None reported
High	CVE-2021-39251	libvirt-daemon-driver-nwfilter: ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open()	7.8	0.0042	None reported
High	CVE-2021-33285	libvirt-daemon-driver-qemu: ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value...	7.8	0.0042	None reported
High	CVE-2021-33287	hivex: ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes	7.8	0.0041	None reported
High	CVE-2021-39255	libguestfs-inspect-icons: ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute	7.8	0.0040	None reported
High	CVE-2021-39258	libguestfs-tools: ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find()	7.8	0.0040	None reported
High	CVE-2021-39259	libguestfs: ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length	7.8	0.0040	None reported
High	CVE-2021-39257	libguestfs-tools-c: ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap	7.8	0.0038	None reported

Also fixes CVE-2021-35267

ALSA-2022:1759
SLOF, hivex, hivex-devel and 127 more on almalinux 8
RHSA-2022:1759
SLOF, hivex, hivex-devel and 127 more on RHEL 8
ELSA-2022-1759
hivex, hivex-devel, libguestfs and 126 more on ol 8
RLSA-2022:1759
hivex, libguestfs, libguestfs-winsupport and 15 more on rocky 8
libntfs-3g88 1:2017.3.23-2ubuntu0.18.04.3
libntfs-3g88 on Ubuntu 18.04.6 LTS (bionic)
libntfs-3g883 1:2017.3.23AR.3-3ubuntu1.1
libntfs-3g883 on Ubuntu 20.04 LTS (focal)
libntfs-3g883 1:2017.3.23AR.3-3ubuntu5
libntfs-3g883 on Ubuntu 22.04.1 LTS (jammy)
ntfs-3g 1:2017.3.23AR.3-3ubuntu1.1
ntfs-3g on Ubuntu 20.04 LTS (focal)

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/ubuntu-bionic-ntfs-3g-1-2017.3.23-2ubuntu0.18.04.3">ntfs-3g 1:2017.3.23-2ubuntu0.18.04.3 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.