Security update for ntfs-3g_ntfsprogs SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1313-1 Final 1 1 2019-05-02T14:25:05Z current 2019-05-02T14:25:05Z 2019-05-02T14:25:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ntfs-3g_ntfsprogs This update for ntfs-3g_ntfsprogs fixes the following issues: Security issues fixed: - CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to local privilege escalation (bsc#1130165). This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00002.html E-Mail link for openSUSE-SU-2019:1313-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libntfs-3g-devel-2013.1.13-7.6.1 libntfs-3g84-2013.1.13-7.6.1 ntfs-3g-2013.1.13-7.6.1 ntfs-3g_ntfsprogs-2013.1.13-7.6.1 ntfsprogs-2013.1.13-7.6.1 libntfs-3g-devel-2013.1.13-7.6.1 as a component of openSUSE Leap 42.3 libntfs-3g84-2013.1.13-7.6.1 as a component of openSUSE Leap 42.3 ntfs-3g-2013.1.13-7.6.1 as a component of openSUSE Leap 42.3 ntfs-3g_ntfsprogs-2013.1.13-7.6.1 as a component of openSUSE Leap 42.3 ntfsprogs-2013.1.13-7.6.1 as a component of openSUSE Leap 42.3 An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. CVE-2019-9755 openSUSE Leap 42.3:libntfs-3g-devel-2013.1.13-7.6.1 openSUSE Leap 42.3:libntfs-3g84-2013.1.13-7.6.1 openSUSE Leap 42.3:ntfs-3g-2013.1.13-7.6.1 openSUSE Leap 42.3:ntfs-3g_ntfsprogs-2013.1.13-7.6.1 openSUSE Leap 42.3:ntfsprogs-2013.1.13-7.6.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00002.html https://www.suse.com/security/cve/CVE-2019-9755.html CVE-2019-9755 https://bugzilla.suse.com/1130165 SUSE Bug 1130165