* [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7
@ 2026-07-16 5:33 Bernd Kuhls
2026-07-17 10:13 ` Julien Olivain via buildroot
2026-07-24 14:14 ` Thomas Perale via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Bernd Kuhls @ 2026-07-16 5:33 UTC (permalink / raw)
To: buildroot
https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History
https://seclists.org/oss-sec/2026/q3/152
Multiple vulnerabilities have been discovered in ntfs-3g.
A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g
(ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)
Switched to sha256 tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/e74561d67caed572396db1839ba0826405cfe43b
package/ntfs-3g/ntfs-3g.hash | 3 ++-
package/ntfs-3g/ntfs-3g.mk | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/package/ntfs-3g/ntfs-3g.hash b/package/ntfs-3g/ntfs-3g.hash
index 3fcba6af4d..6c68f227a8 100644
--- a/package/ntfs-3g/ntfs-3g.hash
+++ b/package/ntfs-3g/ntfs-3g.hash
@@ -1,4 +1,5 @@
+# From https://github.com/tuxera/ntfs-3g/releases/tag/2026.7.7
+sha256 d67b769025d32860549d35c2147e45024d172f81c540d750390ce3602c059dab ntfs-3g_ntfsprogs-2026.7.7.tgz
# Locally calculated
-sha256 f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c ntfs-3g_ntfsprogs-2022.10.3.tgz
sha256 231f7edcc7352d7734a96eef0b8030f77982678c516876fcb81e25b32d68564c COPYING
sha256 d7bf9d064ac3e5840f9dd02422b7eeec4f1fd03f37fadbd043602be5e882304f COPYING.LIB
diff --git a/package/ntfs-3g/ntfs-3g.mk b/package/ntfs-3g/ntfs-3g.mk
index 62c515d50f..b44ad86290 100644
--- a/package/ntfs-3g/ntfs-3g.mk
+++ b/package/ntfs-3g/ntfs-3g.mk
@@ -4,7 +4,7 @@
#
################################################################################
-NTFS_3G_VERSION = 2022.10.3
+NTFS_3G_VERSION = 2026.7.7
NTFS_3G_SOURCE = ntfs-3g_ntfsprogs-$(NTFS_3G_VERSION).tgz
NTFS_3G_SITE = http://tuxera.com/opensource
NTFS_3G_CONF_OPTS = --disable-ldconfig
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7
2026-07-16 5:33 [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7 Bernd Kuhls
@ 2026-07-17 10:13 ` Julien Olivain via buildroot
2026-07-24 14:14 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-07-17 10:13 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
On 16/07/2026 07:33, Bernd Kuhls wrote:
> https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History
> https://seclists.org/oss-sec/2026/q3/152
>
> Multiple vulnerabilities have been discovered in ntfs-3g.
> A new version 2026.7.7 is now available at
> https://github.com/tuxera/ntfs-3g
>
> (ntfscat) Fix heap memory corruption when processing a corrupt or
> maliciously crafted filesystem. (CVE-2026-42616)
> Fix heap memory corruption when copying index data from root to an
> index block in a corrupt or maliciously crafted filesystem.
> (CVE-2026-42617)
> Fix single-byte heap buffer overflow when decompressing maliciously
> crafted compressed file data. (CVE-2026-42618)
> Fix heap buffer overflow when copying the tail data of an index
> block to a freshly allocated block. (CVE-2026-46569)
> Fix out-of-bounds read when processing symlink reparse data in a
> corrupt or maliciously crafted filesystem. (CVE-2026-46571)
> Fix heap memory corruption for maliciously crafted or corrupt index
> data descending to an out-of-bounds tree depth. (CVE-2026-46570)
> Fix heap buffer overflow for maliciously crafted or corrupt index
> data during a node split. (CVE-2026-46572)
> Fix heap buffer overflow when building inherited ACL data.
> (CVE-2026-56135)
> Fix out of bounds access when clearing an index root in maliciously
> crafted or corrupt index data. (CVE-2026-56136)
>
> Switched to sha256 tarball hash provided by upstream.
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7
2026-07-16 5:33 [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7 Bernd Kuhls
2026-07-17 10:13 ` Julien Olivain via buildroot
@ 2026-07-24 14:14 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-07-24 14:14 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: Thomas Perale, buildroot
In reply of:
> https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History
> https://seclists.org/oss-sec/2026/q3/152
>
> Multiple vulnerabilities have been discovered in ntfs-3g.
> A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g
>
> (ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
> Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
> Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
> Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
> Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
> Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
> Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
> Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
> Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)
>
> Switched to sha256 tarball hash provided by upstream.
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to 2026.05.x & 2025.02.x. Thanks
> ---
> Gitlab pipelines passed:
> https://gitlab.com/bkuhls/buildroot/-/commits/e74561d67caed572396db1839ba0826405cfe43b
>
> package/ntfs-3g/ntfs-3g.hash | 3 ++-
> package/ntfs-3g/ntfs-3g.mk | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/package/ntfs-3g/ntfs-3g.hash b/package/ntfs-3g/ntfs-3g.hash
> index 3fcba6af4d..6c68f227a8 100644
> --- a/package/ntfs-3g/ntfs-3g.hash
> +++ b/package/ntfs-3g/ntfs-3g.hash
> @@ -1,4 +1,5 @@
> +# From https://github.com/tuxera/ntfs-3g/releases/tag/2026.7.7
> +sha256 d67b769025d32860549d35c2147e45024d172f81c540d750390ce3602c059dab ntfs-3g_ntfsprogs-2026.7.7.tgz
> # Locally calculated
> -sha256 f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c ntfs-3g_ntfsprogs-2022.10.3.tgz
> sha256 231f7edcc7352d7734a96eef0b8030f77982678c516876fcb81e25b32d68564c COPYING
> sha256 d7bf9d064ac3e5840f9dd02422b7eeec4f1fd03f37fadbd043602be5e882304f COPYING.LIB
> diff --git a/package/ntfs-3g/ntfs-3g.mk b/package/ntfs-3g/ntfs-3g.mk
> index 62c515d50f..b44ad86290 100644
> --- a/package/ntfs-3g/ntfs-3g.mk
> +++ b/package/ntfs-3g/ntfs-3g.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -NTFS_3G_VERSION = 2022.10.3
> +NTFS_3G_VERSION = 2026.7.7
> NTFS_3G_SOURCE = ntfs-3g_ntfsprogs-$(NTFS_3G_VERSION).tgz
> NTFS_3G_SITE = http://tuxera.com/opensource
> NTFS_3G_CONF_OPTS = --disable-ldconfig
> --
> 2.47.3
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-24 14:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-16 5:33 [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7 Bernd Kuhls
2026-07-17 10:13 ` Julien Olivain via buildroot
2026-07-24 14:14 ` Thomas Perale via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox