Fix CVE-2017-0358: http://seclists.org/oss-sec/2017/q1/259 This patch was copied from the above URL. diff --git a/src/lowntfs-3g.c b/src/lowntfs-3g.c index 0bb38f9..c6d1dad 100644 --- a/src/lowntfs-3g.c +++ b/src/lowntfs-3g.c @@ -3827,13 +3827,14 @@ static fuse_fstype load_fuse_module(void) struct stat st; pid_t pid; const char *cmd = "/sbin/modprobe"; + char *env = (char*)NULL; struct timespec req = { 0, 100000000 }; /* 100 msec */ fuse_fstype fstype; if (!stat(cmd, &st) && !geteuid()) { pid = fork(); if (!pid) { - execl(cmd, cmd, "fuse", NULL); + execle(cmd, cmd, "fuse", NULL, &env); _exit(1); } else if (pid != -1) waitpid(pid, NULL, 0); diff -ur ntfs-3g.old/src/ntfs-3g.c ntfs-3g/src/ntfs-3g.c --- ntfs-3g.old/src/ntfs-3g.c 2017-02-09 15:01:04.074331542 -0500 +++ ntfs-3g/src/ntfs-3g.c 2017-02-09 15:06:26.077252571 -0500 @@ -3612,13 +3612,14 @@ struct stat st; pid_t pid; const char *cmd = "/sbin/modprobe"; + char *env = (char*)NULL; struct timespec req = { 0, 100000000 }; /* 100 msec */ fuse_fstype fstype; if (!stat(cmd, &st) && !geteuid()) { pid = fork(); if (!pid) { - execl(cmd, cmd, "fuse", NULL); + execle(cmd, cmd, "fuse", NULL, &env); _exit(1); } else if (pid != -1) waitpid(pid, NULL, 0);