UbuntuUpdates.org

Package "sg3-utils"

Name: sg3-utils

Description:

utilities for devices using the SCSI command set
Latest version: 1.48-3ubuntu3.2
Release: resolute (26.04)
Level: updates
Repository: main
Homepage: https://sg.danny.cz/sg/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sg3-utils"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "sg3-utils" in Resolute

Repository Area Version
base main 1.48-3ubuntu3
security main 1.48-3ubuntu3.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.48-3ubuntu3.2 2026-10-07 15:39:06 UTC

sg3-utils (1.48-3ubuntu3.2) resolute-security; urgency=medium

  * SECURITY UPDATE: command injection via udev property injection
    - debian/patches/CVE-2026-16313.patch: apply udev-conforming character
      encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA
      subfield output of sg_inq --export, so a crafted SCSI device cannot
      inject udev properties and execute commands as root (fix released
      upstream in sg3_utils 1.49).
    - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI
      name strings (upstream follow-up fix).
    - CVE-2026-16313

 -- Allen Huang Thu, 01 Oct 2026 14:12:11 +0100
Source diff to previous version
CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing contr

Version: 1.48-3ubuntu3.1 2026-06-24 22:07:26 UTC

  sg3-utils (1.48-3ubuntu3.1) resolute; urgency=medium

  * d/p/lp2152092-sg_wr_mode-fix-contents-and-cfile=-handling: fix
    command-line argument handling for --contents and --cfile in sg_wr_mode
    (LP: #2152092)
  * d/t/basic-scsi-device:
    - Don't try to install linux-modules-extra anymore.
    - Fix portal cleanup to handle both IPv4 (0.0.0.0) and IPv6 (::0)
      default portal addresses.
    - Use die() instead of bare string on sg_dd commands.

 -- Guilherme Puida Moreira <email address hidden> Thu, 28 May 2026 16:50:21 -0300
2152092 sg_wr_mode rejects every --contents= and --cfile= argument with \


About   -   Send Feedback to @ubuntu_updates