CVE-2019-5094
En bref Sévérité HIGH 7.5 EPSS EPSS 1.10 % · centile 66 (2026-10-27) État PUBLISHED Publiée 2019-09-24 Mise à jour 2026-10-14 Attribuée par talos Statut NVD Modified Description An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H talos CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H NVD · talos-cna@cisco.com (Secondary) CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Secondary) CVSS 3.1 MEDIUM 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:e2fsprogs_project:e2fsprogs:*:*:*:*:*:*:*:* ≥ 1.43.3 ≤ 1.45.3cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*Produits affectés Produit Versions E2fsprogs affected E2fsprogs 1.43.3 - 1.45.3
Références
Sources
