ntfs-3g (1:2022.10.3-1.2ubuntu3.1) noble-security; urgency=medium

  * SECURITY UPDATE: use-after-free in ntfs_uppercase_mbs
    - debian/patches/CVE-2023-52890.patch: fix use-after-free in
      libntfs-3g/unistr.c.
    - CVE-2023-52890
  * SECURITY UPDATE: heap overflow in ntfs_build_permissions_posix()
    - debian/patches/CVE-2026-40706.patch: allocate space for the worst
      case number of ACE entries in libntfs-3g/acls.c.
    - CVE-2026-40706

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 17 Apr 2026 13:52:55 -0400

ntfs-3g (1:2022.10.3-1.2ubuntu3) noble; urgency=high

  * No change rebuild against libgnutls30t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:46:29 +0200

ntfs-3g (1:2022.10.3-1.2ubuntu2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:10:22 +0000

ntfs-3g (1:2022.10.3-1.2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.

 -- Benjamin Drung <bdrung@ubuntu.com>  Thu, 14 Mar 2024 13:32:12 +0100

ntfs-3g (1:2022.10.3-1.2) unstable; urgency=medium

  [ Zixing Liu ]
  * Non-maintainer upload.
  * d/rules: add t64 suffix to the dh_makeshlib command. (Closes: #1066074)

 -- Benjamin Drung <bdrung@debian.org>  Thu, 14 Mar 2024 13:21:45 +0100

ntfs-3g (1:2022.10.3-1.1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.

 -- Dan Bungert <daniel.bungert@canonical.com>  Mon, 04 Mar 2024 15:39:37 -0700

ntfs-3g (1:2022.10.3-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1063180

 -- Benjamin Drung <bdrung@debian.org>  Fri, 01 Mar 2024 12:40:22 +0000

ntfs-3g (1:2022.10.3-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.

 -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 14 Feb 2023 12:47:55 -0700

ntfs-3g (1:2022.10.3-1) unstable; urgency=high

  * New upstream release:
    - fixes CVE-2022-40284: potential execution of arbitrary privileged code
    via a maliciously crafted NTFS-formatted image file or external storage.
  * Remove libfuse-dev build dependency (closes: #1003676).
  * Depend on fuse3 binaries (closes: #1003675).
  * Update copyright file.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Mon, 31 Oct 2022 15:14:06 +0100

ntfs-3g (1:2022.5.17-1ubuntu1.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: code execution via incorrect validation of metadata
    - debian/patches/CVE-2022-40284-1.patch: rejected zero-sized runs in
      libntfs-3g/runlist.c.
    - debian/patches/CVE-2022-40284-2.patch: avoided merging runlists with
      no runs in libntfs-3g/runlist.c.
    - CVE-2022-40284

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 01 Nov 2022 07:53:35 -0400

ntfs-3g (1:2022.5.17-1ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/ntfs-3g.postinst: don't install /bin/ntfs-3g as setuid root.
    - debian/control: don't Build-Depends on libfuse-dev since the package
      is built using the --with-fuse=internal option, switch to fuse3.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Jun 2022 10:33:43 -0400

ntfs-3g (1:2022.5.17-1) unstable; urgency=high

  * New upstream release (closes: #1011770) fixing CVE-2021-46790,
    CVE-2022-30783, CVE-2022-30784, CVE-2022-30785, CVE-2022-30786,
    CVE-2022-30787, CVE-2022-30788 and CVE-2022-30789: these vulnerabilities
    may allow an attacker using a maliciously crafted NTFS-formatted image
    file or external storage to potentially execute arbitrary privileged code.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 26 May 2022 19:04:15 +0200

ntfs-3g (1:2021.8.22-3ubuntu1) jammy; urgency=medium

  * debian/control: 
    - don't Build-Depends on libfuse-dev since the package is built using
      the --with-fuse=internal option, switch to fuse3
     
  [ Simon Chopin ]
  * Merge with Debian unstable (LP: #1951239). Remaining changes:
    + Don't install /bin/ntfs-3g as setuid root.
  * Dropped, merged upstream:
    + SECURITY UPDATE: multiple security issues
      debian/patches/aug2021-security.patch: backport fixes from new
      upstream version.
      - CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,
        CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,
        CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254,
        CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258,
        CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262,
        CVE-2021-39263

 -- Sebastien Bacher <seb128@ubuntu.com>  Thu, 13 Jan 2022 15:38:10 +0100

ntfs-3g (1:2021.8.22-3) unstable; urgency=medium

  * Backport upstream documentation updates.
  * Update homepage location (closes: #993989).
  * Update watch file.
  * Update Standards-Version to 4.6.0 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 10 Oct 2021 19:59:33 +0200

ntfs-3g (1:2021.8.22-2) unstable; urgency=medium

  * Upload to Sid.

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sun, 05 Sep 2021 19:18:32 +0200

ntfs-3g (1:2021.8.22-1) experimental; urgency=high

  * New upstream release (closes: #988386) fixing CVE-2021-33285,
    CVE-2021-35269, CVE-2021-35268, CVE-2021-33289, CVE-2021-33286,
    CVE-2021-35266, CVE-2021-33287, CVE-2021-35267, CVE-2021-39251,
    CVE-2021-39252, CVE-2021-39253, CVE-2021-39254, CVE-2021-39255,
    CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259,
    CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263: multiple
    buffer overflows.
  * Library transition from libntfs-3g886 to libntfs-3g89 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 02 Sep 2021 18:10:12 +0200

ntfs-3g (1:2017.3.23AR.6-1) experimental; urgency=medium

  * New upstream release.
  * Library transition from libntfs-3g885 to libntfs-3g886 .
  * Update debhelper level to 13 .
  * Update Standards-Version to 4.5.1 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Sat, 14 Aug 2021 17:04:15 +0200

ntfs-3g (1:2017.3.23AR.5-1) experimental; urgency=medium

  * New upstream release.
  * Library transition from libntfs-3g884 to libntfs-3g885 .
  * Update Standards-Version to 4.5.0 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 12 Jun 2020 10:44:39 +0200

ntfs-3g (1:2017.3.23AR.4-1) experimental; urgency=medium

  * New upstream release.
  * Prevent installation of hal/fdi/policy (closes: #913281).
  * Library transition from libntfs-3g883 to libntfs-3g884 .

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 26 Jul 2019 18:13:42 +0000

ntfs-3g (1:2017.3.23AR.3-3ubuntu5) impish; urgency=medium

  * SECURITY UPDATE: multiple security issues
    - debian/patches/aug2021-security.patch: backport fixes from new
      upstream version.
    - CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,
      CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,
      CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254,
      CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258,
      CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262,
      CVE-2021-39263

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 23 Aug 2021 09:10:28 -0400

ntfs-3g (1:2017.3.23AR.3-3ubuntu4) hirsute; urgency=medium

  * No-change rebuild to drop the udeb package.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 25 Feb 2021 06:59:05 +0100

ntfs-3g (1:2017.3.23AR.3-3ubuntu3) hirsute; urgency=medium

  * No-change rebuild to drop the udeb package.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 22 Feb 2021 10:35:40 +0100

ntfs-3g (1:2017.3.23AR.3-3ubuntu2) groovy; urgency=medium

  * No change rebuild to gain CET protection

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 18 Jun 2020 18:54:35 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libntfs-3g89t64`.
