UbuntuUpdates.org

Package "sg3-utils-udev"

Name: sg3-utils-udev

Description:

utilities for devices using the SCSI command set (udev rules)
Latest version: 1.46-3ubuntu4.1
Release: noble (24.04)
Level: security
Repository: main
Head package: sg3-utils
Homepage: https://sg.danny.cz/sg/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sg3-utils-udev"

All arch deb package
APT INSTALL

Other versions of "sg3-utils-udev" in Noble

Repository Area Version
base main 1.46-3ubuntu4
updates main 1.46-3ubuntu4.1

Changelog

Version: 1.46-3ubuntu4.1 2026-10-07 15:38:18 UTC

sg3-utils (1.46-3ubuntu4.1) noble-security; urgency=medium

  * SECURITY UPDATE: command injection via udev property injection
    - debian/patches/CVE-2026-16313.patch: apply udev-conforming character
      encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA
      subfield output of sg_inq --export, so a crafted SCSI device cannot
      inject udev properties and execute commands as root (fix released
      upstream in sg3_utils 1.49).
    - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI
      name strings (upstream follow-up fix).
    - CVE-2026-16313

 -- Allen Huang Thu, 01 Oct 2026 14:12:14 +0100
CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing contr


About   -   Send Feedback to @ubuntu_updates