The vulnerability of the e2fsprogs utility for working with ext2, ext3, and ext4 file systems lies in the ability to write beyond the cluster boundaries, allowing an attacker to execute arbitrary code.

🗓️ 17 Dec 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The e2fsprogs vulnerability allows remote code execution by writing beyond cluster boundaries.

Reporter	Title	Published	Views	Family All 117
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	15 Apr 202221:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	19 Jul 202221:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
FreeBSD	e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck	23 Sep 201900:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : e2fsprogs (ALAS-2020-1509)	27 Oct 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : e2fsprogs (ALAS-2020-1459) (deprecated)	19 Dec 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : e2fsprogs (ALAS-2021-1458)	14 Jan 202100:00	–	nessus
Tenable Nessus	CentOS 8 : e2fsprogs (CESA-2020:1913)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : e2fsprogs (RHSA-2020:4011)	20 Oct 202000:00	–	nessus

Vulners

Node

theodore_ts'o e2fsprogsMatch1.45.3

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.0

OR

novell opensuse_leapMatch15.1

OR

fedora fedoraMatch30

OR

fedora fedoraMatch31

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-5094
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-5094
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2019-0887
suse	www.suse.com/security/cve/CVE-2019-5094/
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
access	www.access.redhat.com/security/cve/cve-2019-5094
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81
wiki	www.wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15

21 Nov 2023 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 36.7

CVSS 26.8

EPSS0.00378

e2fsprogs vulnerability remote code execution cluster boundaries extended file systems