Change logs for ntfs-3g source package in Lunar

  • ntfs-3g (1:2022.10.3-1ubuntu1) lunar; urgency=medium
    
      * Merge with Debian unstable. Remaining changes:
        - debian/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.
    
     -- Dan Bungert <email address hidden>  Tue, 14 Feb 2023 12:47:55 -0700
  • ntfs-3g (1:2022.5.17-1ubuntu1.1) kinetic-security; urgency=medium
    
      * SECURITY UPDATE: code execution via incorrect validation of metadata
        - debian/patches/CVE-2022-40284-1.patch: rejected zero-sized runs in
          libntfs-3g/runlist.c.
        - debian/patches/CVE-2022-40284-2.patch: avoided merging runlists with
          no runs in libntfs-3g/runlist.c.
        - CVE-2022-40284
    
     -- Marc Deslauriers <email address hidden>  Tue, 01 Nov 2022 07:53:35 -0400
  • ntfs-3g (1:2022.5.17-1ubuntu1) kinetic; urgency=medium
    
      * Merge with Debian unstable. Remaining changes:
        - debian/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.
        - debian/control: don't Build-Depends on libfuse-dev since the package
          is built using the --with-fuse=internal option, switch to fuse3.
    
    ntfs-3g (1:2022.5.17-1) unstable; urgency=high
    
      * New upstream release (closes: #1011770) fixing CVE-2021-46790,
        CVE-2022-30783, CVE-2022-30784, CVE-2022-30785, CVE-2022-30786,
        CVE-2022-30787, CVE-2022-30788 and CVE-2022-30789: these vulnerabilities
        may allow an attacker using a maliciously crafted NTFS-formatted image
        file or external storage to potentially execute arbitrary privileged code.
    
     -- Marc Deslauriers <email address hidden>  Tue, 07 Jun 2022 10:33:43 -0400