-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 05 Nov 2026 09:57:47 -0600 Source: ntfs-3g Architecture: source Version: 1:2022.10.3-1+deb12u4 Distribution: bookworm-security Urgency: high Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org> Changed-By: Simon Quigley <tsimonq2@debian.org> Changes: ntfs-3g (1:2022.10.3-1+deb12u4) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-42616: heap buffer overflow in cat() in ntfscat. * CVE-2026-42617: heap buffer overflow in ntfs_ir_truncate(). * CVE-2026-42618: heap buffer overflow in ntfs_decompress(). * CVE-2026-46569: heap buffer overflow in ntfs_ib_copy_tail(). * CVE-2026-46570: heap buffer overflow in ntfs_index_walk_down(). * CVE-2026-46571: out-of-bounds read in ntfs_fix_file_name(). * CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail(). * CVE-2026-56135: heap buffer overflow in ACL handling. * CVE-2026-56136: out-of-bounds read in ntfs_ir_lookup(). * GHSA-r6xj-6488-p8mv: heap out of bounds read/write in ntfs_ie_add_vcn(). * GHSA-mc3c-983p-wqm8: heap corruption in ntfs_mapping_pairs_decompress_i(). * GHSA-wf3w-fjjg-x4w3: heap buffer overflow in ntfs_external_attr_find(). * GHSA-2c97-47cr-9xr8: heap buffer overflow in ntfs_ea_check_wsldev(). * GHSA-xrvx-6jrp-4q3x: heap buffer overflow in ntfs_check_restart_area(). * GHSA-jcjj-9262-6j6p: denial of service in ntfs_inode_attach_all_extents(). * GHSA-x98j-3g35-f59x: heap buffer overflow in ntfs_same_sid(). * GHSA-pc48-m7cx-qf72: heap buffer overflow in ntfs_acl_owner(). * Revert the multi-sector transfer hard-fail in attrib.c (9398030d). It came in with GHSA-mc3c-983p-wqm8 and broke creating files and directories (upstream issues #217 and #218). Checksums-Sha1: 7ae77dddc700e2016383e6e8787334c37f93df0e 2134 ntfs-3g_2022.10.3-1+deb12u4.dsc 306c524e5c5ccc0dc04a8cf60a4823e03eb7e66f 43492 ntfs-3g_2022.10.3-1+deb12u4.debian.tar.xz 9713f48f9c624fb5269a429b44bbdd760f757e29 7017 ntfs-3g_2022.10.3-1+deb12u4_source.buildinfo Checksums-Sha256: 82894dcb9fa73b85f3c7b4ffef2f9cc54f963fefc29865e9b6d0656d63a99eaf 2134 ntfs-3g_2022.10.3-1+deb12u4.dsc 9036c3b839bcf37853a043f4e4e315f8481a9f7ff21ee258720baf6b3b5de5b7 43492 ntfs-3g_2022.10.3-1+deb12u4.debian.tar.xz 104af8f0bb84103d0cddf9f74c428a927a237e3b083c14173b28ee334508beed 7017 ntfs-3g_2022.10.3-1+deb12u4_source.buildinfo Files: 06b4e25ee0198144b27a75267ea883a9 2134 otherosfs optional ntfs-3g_2022.10.3-1+deb12u4.dsc c8c6e53a82f8a88bcce475fcb22c46d0 43492 otherosfs optional ntfs-3g_2022.10.3-1+deb12u4.debian.tar.xz b517aaea11cf4821b5c1427f7af6a1a5 7017 otherosfs optional ntfs-3g_2022.10.3-1+deb12u4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrsp50ACgkQ4n8s+EWM L6Q8Lg//RE4tM3vw9oIjCwFchpZz/qfmhO3rorRf0nxClWMRGJ3G0GDVxgH42SRs YJfrE13pmqb6fa/NE7c4L0qaON+A6F2RU8RgP2DaPm3Hck3KhFeDBoZ0HHc+IZGU W9TOmXbb5M51gAKiT0DWHrRkYcpMg+/muo4MZTAINbzo2W5KXfFMgKqCPh4IHATO CneuCv7+WMPRANgQpbmFd1LSKz3idJwLakFvHHKigJj8sFgSMGgY8cOhi0KKK0aI lPF8MQ/JJ9QgZ71Len4sSKp+/9oghNkz2zvIUEOFTgHMpkFrTpT3uQBr/ZoGER1X DSL6NnJ3DkHgTbwXhCDPLaqAX+6zXtQzePhKqBnPkXDeU8sZseWqObFXYl9Sr18l lkbhUhmZO2d9DoOVS5biqwsskBgh7cjyESrT/2s7A4inTXa7zjD4fK06Ac4fSEp4 dqSgvNckP2hMJzM83RAbTY1yBUwWdpBfkshcRHXI0jJApgbRj7oT8PK9vd7XNYh0 K9c/IpkxyCRcLs+nzXr3f/jTZOQX1WJ1sAdcVCGRlIsNCn8PGTZSl4EhFyKEPRHl ZBACt8sOwLN7C6IGbSvY0+0q5Qpq043OMRnMz0kH6zi+xKfOy4zbCTArqRkD+Q/b 1/jR+AdsXgzGmzY0OerjQ1yriVatM4GCNGZJxkyTRkVkvpRtahw= =DiyT -----END PGP SIGNATURE-----
