CVE-2015-1572: Buffer Overflow
Published Feb 24, 2015
·Updated
Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.
Affected Software
6 affected components
E2fsprogs Project E2fsprogs<=1.42.11
Debian Debian Linux=7.0
Canonical Ubuntu Linux=10.04
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Event History
Feb 24, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1572?
CVE-2015-1572 is considered critical due to its potential for arbitrary code execution.
2
How do I fix CVE-2015-1572?
To fix CVE-2015-1572, update e2fsprogs to version 1.42.12 or later.
3
Who is affected by CVE-2015-1572?
CVE-2015-1572 affects users of e2fsprogs versions up to and including 1.42.11 on various Linux distributions.
4
What is the nature of the vulnerability in CVE-2015-1572?
CVE-2015-1572 is a heap-based buffer overflow vulnerability that allows local users to execute arbitrary code.
5
Why does CVE-2015-1572 exist?
CVE-2015-1572 exists due to an incomplete fix for the earlier CVE-2015-0247 vulnerability.