Hi Sylvain, On 11/5/26 11:54, Sylvain Beucler wrote:
Hi,On 05/11/2026 17:29, Simon Quigley wrote:Package : ntfs-3g Version : 1:2022.10.3-1+deb12u4 CVE ID : CVE-2026-42616 CVE-2026-42617 CVE-2026-42618 CVE-2026-46569 CVE-2026-46570 CVE-2026-46571 CVE-2026-46572 CVE-2026-56135 CVE-2026-56136 TEMP-0000000-D7723D TEMP-0000000-B9374C TEMP-0000000-724ECC TEMP-0000000-575F54 TEMP-0000000-52FEFD TEMP-0000000-37DA2F TEMP-0000000-17A9B4 TEMP-0000000-001B0EPlease don't use TEMP-*. As mentioned in the web tracker: "Automatically generated temporary name. Not for external reference." https://security-tracker.debian.org/tracker/TEMP-1147318-639065 They can change before a CVE get assigned, and won't be findable after the CVE is assigned. In this case just do not mention them, or mention that the CVE for some of the vulnerabilities is not yet available.
Thanks for the information here; I won't do that again. Is there anything I should do at this point in terms of a followup?
ntfs-3g is a read-write NTFS driver for FUSE. A crafted NTFS filesystem can crash the mount helper or the ntfsprogs tools, or disclose process memory. ntfs-3g is installed setuid root, so a local user who can mount such a filesystem can reach these bugs.Nitpick-ish, but we usually try to convey the impact of attacks (e.g. denial-of-service; not sure about the consequence of memory disclosure for one's own ntfs-3g process here). The person exploiting the vulnerabilities can be called "attacker" rather than "user" for clarity (e.g. "an attacker with local access"). In https://lts-team.pages.debian.net/wiki/Development.html#announce-the-update we recently proposed to get one's DLAs texts acked/proofread by another contributor, to have a chance to identify this as well as last-minute typos.
Thanks! Going forward, I'll attach the proposed DLA text to my review email, to hopefully help identify this sort of thing. I sincerely appreciate your time, guidance, and advice, on this and other packages. Feedback is still welcome, please let me know if you think of anything else. Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
