7.5
High
CVE-2019-5094 An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3
Description
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| E2fsprogs | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- DSA-4535 www.debian.org
- [debian-lts-announce] 20190928 [SECURITY] [DLA 1935-1] e2fsprogs security update lists.debian.org
- 20190929 [SECURITY] [DSA 4535-1] e2fsprogs security update seclists.org
- USN-4142-2 usn.ubuntu.com
- USN-4142-1 usn.ubuntu.com
- FEDORA-2020-a724cc7926 lists.fedoraproject.org
- FEDORA-2020-01ed02451f lists.fedoraproject.org
- GLSA-202003-05 security.gentoo.org
- talosintelligence.com talosintelligence.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified