CVE-2018-11728

Name of the Vulnerable Software and Affected Versions libfsntfs versions through 2018-04-20

Description The issue allows remote attackers to cause an information disclosure via a crafted ntfs file. This is due to a heap-based buffer over-read in the libfsntfs reparse point values read data function in libfsntfs reparse point values.c. The vendor has disputed this issue, as described in libyal/libfsntfs issue 8 on GitHub.

Recommendations For versions through 2018-04-20, consider disabling the libfsntfs reparse point values read data function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.