CVE-2019-5094
At a glance Severity HIGH 7.5 EPSS EPSS 1.10 % · percentile 66 (2026-10-27) State PUBLISHED Published 2019-09-24 Updated 2026-10-14 Assigner talos NVD status Modified Description An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H talos CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H NVD · talos-cna@cisco.com (Secondary) CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Secondary) CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:e2fsprogs_project:e2fsprogs:*:*:*:*:*:*:*:* ≥ 1.43.3 ≤ 1.45.3cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*Affected products Product Versions E2fsprogs affected E2fsprogs 1.43.3 - 1.45.3
References
Sources
