UbuntuUpdates.org

Package "sg3-utils"

Name: sg3-utils

Description:

utilities for devices using the SCSI command set
Latest version: 1.48-3ubuntu3.2
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://sg.danny.cz/sg/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sg3-utils"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "sg3-utils" in Resolute

Repository Area Version
base main 1.48-3ubuntu3
updates main 1.48-3ubuntu3.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.48-3ubuntu3.2 2026-10-07 15:39:01 UTC

sg3-utils (1.48-3ubuntu3.2) resolute-security; urgency=medium

  * SECURITY UPDATE: command injection via udev property injection
    - debian/patches/CVE-2026-16313.patch: apply udev-conforming character
      encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA
      subfield output of sg_inq --export, so a crafted SCSI device cannot
      inject udev properties and execute commands as root (fix released
      upstream in sg3_utils 1.49).
    - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI
      name strings (upstream follow-up fix).
    - CVE-2026-16313

 -- Allen Huang Thu, 01 Oct 2026 14:12:11 +0100
CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing contr


About   -   Send Feedback to @ubuntu_updates