CVE-2022-30786 A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
HighCVSS 7.8
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntfs-3g(Debian:12) | < 1:2022.5.17-1 | 1:2022.5.17-1 |
| debian/ntfs-3g(Debian:13) | < 1:2022.5.17-1 | 1:2022.5.17-1 |
| debian/ntfs-3g(Debian:14) | < 1:2022.5.17-1 | 1:2022.5.17-1 |
| ubuntu/ntfs-3g(Ubuntu:22.04) | < 1:2021.8.22-3ubuntu1.1 | 1:2021.8.22-3ubuntu1.1 |
| Tuxera NTFS-3G | <= 2021.8.22 | No fix listed |
| fedoraproject fedora | = 35 | No fix listed |
| fedoraproject fedora | = 36 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| debian linux | = 11.0 | No fix listed |
| alpine/ntfs-3g(Alpine:v3.16) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.17) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.18) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.19) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.20) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.21) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.22) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.23) | < 2022.5.17-r0 | 2022.5.17-r0 |
| alpine/ntfs-3g(Alpine:v3.24) | < 2022.5.17-r0 | 2022.5.17-r0 |
References
- Debian Security Tracker CVE-2022-30786 vendor-advisory
- github.com release-notes third-party-advisory
- github.com third-party-advisory
- DSA-5160 third-party-advisory vendor-advisory
- FEDORA-2022-8f775872c9 vendor-advisory
- FEDORA-2022-13bc8c91b0 vendor-advisory
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update mailing-list third-party-advisory
- FEDORA-2022-8fa7e5aeaf vendor-advisory
- FEDORA-2022-1176b501f0 vendor-advisory
- GLSA-202301-01 third-party-advisory vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-5463-1 vendor-advisory
- USN-5463-2 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking