Hi,
On 05/11/2026 17:29, Simon Quigley wrote:
Package : ntfs-3g
Version : 1:2022.10.3-1+deb12u4
CVE ID : CVE-2026-42616 CVE-2026-42617 CVE-2026-42618 CVE-2026-46569
CVE-2026-46570 CVE-2026-46571 CVE-2026-46572 CVE-2026-56135
CVE-2026-56136 TEMP-0000000-D7723D TEMP-0000000-B9374C
TEMP-0000000-724ECC TEMP-0000000-575F54 TEMP-0000000-52FEFD
TEMP-0000000-37DA2F TEMP-0000000-17A9B4 TEMP-0000000-001B0E
Please don't use TEMP-*. As mentioned in the web tracker:
"Automatically generated temporary name. Not for external reference."
https://security-tracker.debian.org/tracker/TEMP-1147318-639065
They can change before a CVE get assigned, and won't be findable after
the CVE is assigned.
In this case just do not mention them, or mention that the CVE for some
of the vulnerabilities is not yet available.
ntfs-3g is a read-write NTFS driver for FUSE.
A crafted NTFS filesystem can crash the mount helper or the ntfsprogs
tools, or disclose process memory. ntfs-3g is installed setuid root, so
a local user who can mount such a filesystem can reach these bugs.
Nitpick-ish, but we usually try to convey the impact of attacks (e.g.
denial-of-service; not sure about the consequence of memory disclosure
for one's own ntfs-3g process here). The person exploiting the
vulnerabilities can be called "attacker" rather than "user" for clarity
(e.g. "an attacker with local access").
In
https://lts-team.pages.debian.net/wiki/Development.html#announce-the-update
we recently proposed to get one's DLAs texts acked/proofread by another
contributor, to have a chance to identify this as well as last-minute typos.
Cheers!
Sylvain
