diff options
| author | Peter Korsgaard <peter@korsgaard.com> | 2017-02-13 23:51:10 +0100 |
|---|---|---|
| committer | Peter Korsgaard <peter@korsgaard.com> | 2017-02-14 11:18:38 +0100 |
| commit | 6f971f354c14a8948477a0936668b8baae8ec86e (patch) | |
| tree | 6907f9aa43fd0007b63fd17fe59c898c30541ca9 /package/redis/redis.hash | |
| parent | 0e76cde70f651b17e74681d17fb0afb16400102d (diff) | |
| download | buildroot-6f971f354c14a8948477a0936668b8baae8ec86e.tar.gz buildroot-6f971f354c14a8948477a0936668b8baae8ec86e.zip | |
ntfs-3g: add security fix for CVE-2017-0358
Jann Horn, Project Zero (Google) discovered that ntfs-3g, a read-write
NTFS driver for FUSE does not not scrub the environment before
executing modprobe to load the fuse module. This influence the behavior
of modprobe (MODPROBE_OPTIONS environment variable, --config and
--dirname options) potentially allowing for local root privilege
escalation if ntfs-3g is installed setuid.
Notice that Buildroot does NOT install netfs-3g setuid root, but custom
permission tables might be used, causing it to vulnerable to the above.
ntfs-3g does not seem to have a publicly available version control system
and no new releases have been made, so instead grab the patch from Debian.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Diffstat (limited to 'package/redis/redis.hash')
0 files changed, 0 insertions, 0 deletions
