From: Julien Olivain via buildroot <buildroot@buildroot.org>
To: Bernd Kuhls <bernd@kuhls.net>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7
Date: Fri, 17 Jul 2026 12:13:16 +0200 [thread overview]
Message-ID: <3bf41a357bacda5e973a23a622edceb4@free.fr> (raw)
In-Reply-To: <20260716053350.11727-1-bernd@kuhls.net>
On 16/07/2026 07:33, Bernd Kuhls wrote:
> https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History
> https://seclists.org/oss-sec/2026/q3/152
>
> Multiple vulnerabilities have been discovered in ntfs-3g.
> A new version 2026.7.7 is now available at
> https://github.com/tuxera/ntfs-3g
>
> (ntfscat) Fix heap memory corruption when processing a corrupt or
> maliciously crafted filesystem. (CVE-2026-42616)
> Fix heap memory corruption when copying index data from root to an
> index block in a corrupt or maliciously crafted filesystem.
> (CVE-2026-42617)
> Fix single-byte heap buffer overflow when decompressing maliciously
> crafted compressed file data. (CVE-2026-42618)
> Fix heap buffer overflow when copying the tail data of an index
> block to a freshly allocated block. (CVE-2026-46569)
> Fix out-of-bounds read when processing symlink reparse data in a
> corrupt or maliciously crafted filesystem. (CVE-2026-46571)
> Fix heap memory corruption for maliciously crafted or corrupt index
> data descending to an out-of-bounds tree depth. (CVE-2026-46570)
> Fix heap buffer overflow for maliciously crafted or corrupt index
> data during a node split. (CVE-2026-46572)
> Fix heap buffer overflow when building inherited ACL data.
> (CVE-2026-56135)
> Fix out of bounds access when clearing an index root in maliciously
> crafted or corrupt index data. (CVE-2026-56136)
>
> Switched to sha256 tarball hash provided by upstream.
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2026-07-17 10:13 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-16 5:33 [Buildroot] [PATCH 1/1] package/ntfs-3g: security bump version to 2026.7.7 Bernd Kuhls
2026-07-17 10:13 ` Julien Olivain via buildroot [this message]
2026-07-24 14:14 ` Thomas Perale via buildroot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3bf41a357bacda5e973a23a622edceb4@free.fr \
--to=buildroot@buildroot.org \
--cc=bernd@kuhls.net \
--cc=ju.o@free.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox