CVE-2023-52890

NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.5 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
mitreCNA
---
---
CISA-ADPADP
4.5 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Debian logo
Debian Releases
Debian Product
Codename
ntfs-3g
bullseye
1:2017.3.23AR.3-4+deb11u4
fixed
buster
postponed
bullseye (security)
vulnerable
bookworm
1:2022.10.3-1+deb12u2
fixed
sid
1:2022.10.3-5
fixed
trixie
1:2022.10.3-5
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ntfs-3g
oracular
needed
noble
needed
mantic
ignored
jammy
needed
focal
needed
bionic
needed
xenial
needed
trusty
ignored
References
https://github.com/tuxera/ntfs-3g/issues/84
https://github.com/tuxera/ntfs-3g/issues/84