CVE-2021-39254

Una imagen NTFS diseñada puede causar un desbordamiento de enteros en memmove, lo que conlleva un desbordamiento del búfer basado en la pila en la función ntfs_attr_record_resize, en NTFS-3G versiones anteriores a 2021.8.22

The ntfs3g package is susceptible to an input validation flaw. A crafted NTFS image with invalid values could trigger an improper check. This incorrect check causes an integer overflow which then leads to a heap overflow. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Kernel-based Virtual Machine offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Issues addressed include buffer overflow, integer overflow, null pointer, out of bounds access, out of bounds read, and use-after-free vulnerabilities.