CVE-2023-52890

published 2024-06-13

CVE-2023-52890: NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.

Priority P4 18 medium 4.5 CVSS 3.1

AV L AC H PR L UI N S U C L I L A L

NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	ntfs-3g	< ntfs-3g 1:2022.10.3-1+deb12u1 (bookworm)	ntfs-3g 1:2022.10.3-1+deb12u1 (bookworm)
msrc	azl3_ntfs-3g_2022.10.3-2_on_azure_linux_3.0	—	—
msrc	azure_linux_3.0_arm	—	—
msrc	azure_linux_3.0_x64	—	—
msrc	cbl2_ntfs-3g_2022.10.3-2_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
tuxera	ntfs-3g	>= 0 < 1:2017.3.23AR.3-4+deb11u4	1:2017.3.23AR.3-4+deb11u4
tuxera	ntfs-3g	>= 0 < 1:2022.10.3-1+deb12u1	1:2022.10.3-1+deb12u1
tuxera	ntfs-3g	>= 0 < 1:2022.10.3-3	1:2022.10.3-3
tuxera	ntfs-3g	>= 0 < 1:2022.10.3-3	1:2022.10.3-3

CVSS provenance

nvd v3.1 4.5 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

osv 4.5 MEDIUM

vendor_debian 4.5 MEDIUM

vendor_msrc 4.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.