DFSG, Licensing & New Packages Team

ntfs-3g (1:2026.7.7-1) experimental; urgency=medium
 .
   * New upstream release (closes: #1142144):
     - fixes CVE-2026-42616: heap buffer overflow in cat(),
     - fixes CVE-2026-42617: heap buffer overflow in ntfs_ir_to_ib(),
     - fixes CVE-2026-42618: heap buffer overflow in ntfs_decompress(),
     - fixes CVE-2026-46569: missing range check in ntfs_ib_copy_tail(),
     - fixes CVE-2026-46570: heap memory corruption in ntfs_index_walk_down(),
     - fixes CVE-2026-46571: out of bounds read in ntfs_fix_file_name(),
     - fixes CVE-2026-46572: heap buffer overflow in ntfs_ib_cut_tail(),
     - fixes CVE-2026-56135: heap buffer overflow in build_inherited_id(),
     - fixes CVE-2026-56136: out of bounds memmove in ntfs_ir_nill().
   * Update copyright file.
   * Update Standards-Version to 4.7.2 .
   * Library transition from libntfs-3g89 to libntfs-3g90 .

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: ntfs-3g
Upstream-Contact: https://github.com/tuxera/ntfs-3g/issues
Source: https://github.com/tuxera/ntfs-3g

Files: *
Copyright: 2000-2014 ntfs-3g Development Team
License: GPL-2+

Files: include/fuse-lite/* libfuse-lite/*
Copyright: 2000-2013 ntfs-3g Development Team
License: LGPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published
 by the Free Software Foundation; version 2 of the License.
 .
 On Debian systems, the full text of the GNU Lesser General Public License
 version 2 can be found in the file `/usr/share/common-licenses/LGPL-2'.

Files: include/fuse-lite/fuse_kernel.h
Copyright: 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
License: GPL or BSD-2-Clause

Files: libfuse-lite/fusermount.c
Copyright: 2001-2007  Miklos Szeredi <miklos@szeredi.hu>
License: GPL

Files: ntfsprogs/boot.c
Copyright:  1991 Linus Torvalds <torvalds@klaava.helsinki.fi>
 1992-1993 Remy Card <card@masi.ibp.fr>
 1993-1994 David Hudson <dave@humbug.demon.co.uk>
 1998 H. Peter Anvin <hpa@zytor.com>
 1998-2005 Roman Hodek <Roman.Hodek@informatik.uni-erlangen.de>
 2008-2014 Daniel Baumann <mail@daniel-baumann.ch>
 2015 Andreas Bombe <aeb@debian.org>
License: GPL-3+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 3 of the License, or
 (at your option) any later version.
 .
 On Debian systems, the full text of the GNU General Public License
 version 3 can be found in the file `/usr/share/common-licenses/GPL-3`.

Files: debian/*
Copyright: 2014-     Laszlo Boszormenyi (GCS) <gcs@debian.org>,
 2011-2014 Daniel Baumann <mail@daniel-baumann.ch>,
 2006-2010 Adam Cecile <gandalf@le-vert.net>
License: GPL-2+

License: BSD-2-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
 1. Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 2. Redistributions in binary form must reproduce the above copyright
    notice, this list of conditions and the following disclaimer in the
    documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
 OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY
 WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
 OF SUCH DAMAGE.

License: GPL
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 1, or (at your option)
 any later version.
 .
 On Debian systems, the complete text of the GNU General Public
 License, version 1, can be found in `/usr/share/common-licenses/GPL`.

License: GPL-2+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation, either version 2 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 The complete text of the GNU General Public License
 can be found in /usr/share/common-licenses/GPL-2 file.

License: LGPL-2+
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU Lesser General Public License as published by
 the Free Software Foundation, either version 2 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 GNU Lesser General Public License for more details.
 .
 You should have received a copy of the GNU Lesser General Public License
 along with this program. If not, see <https://www.gnu.org/licenses/>.
 .
 The complete text of the GNU Lesser General Public License
 can be found in /usr/share/common-licenses/LGPL-2 file.