An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
References
Link | Resource |
---|---|
https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/ | |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/ | |
https://seclists.org/bugtraq/2019/Sep/58 | Mailing List Third Party Advisory |
https://security.gentoo.org/glsa/202003-05 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20200115-0002/ | Third Party Advisory |
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 | Exploit Third Party Advisory |
https://usn.ubuntu.com/4142-1/ | Third Party Advisory |
https://usn.ubuntu.com/4142-2/ | Third Party Advisory |
https://www.debian.org/security/2019/dsa-4535 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
07 Nov 2023, 03:11
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
27 Jun 2022, 17:23
Type | Values Removed | Values Added |
---|---|---|
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/ - Mailing List, Third Party Advisory |
11 Jan 2021, 19:21
Type | Values Removed | Values Added |
---|---|---|
References | (UBUNTU) https://usn.ubuntu.com/4142-1/ - Third Party Advisory | |
References | (UBUNTU) https://usn.ubuntu.com/4142-2/ - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2019/dsa-4535 - Third Party Advisory | |
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20200115-0002/ - Third Party Advisory | |
References | (GENTOO) https://security.gentoo.org/glsa/202003-05 - Third Party Advisory | |
References | (MLIST) https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/ - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/ - Third Party Advisory | |
References | (BUGTRAQ) https://seclists.org/bugtraq/2019/Sep/58 - Mailing List, Third Party Advisory | |
CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* cpe:2.3:a:e2fsprogs_project:e2fsprogs:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
Information
Published : 2019-09-24 22:15
Updated : 2023-12-10 13:13
NVD link : CVE-2019-5094
Mitre link : CVE-2019-5094
CVE.ORG link : CVE-2019-5094
JSON object : View
Products Affected
netapp
- hci_management_node
- solidfire
canonical
- ubuntu_linux
fedoraproject
- fedora
e2fsprogs_project
- e2fsprogs
debian
- debian_linux
CWE
CWE-787
Out-of-bounds Write