CVE-2019-5094: High severity IBM Security Guardium vulnerability
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Other sources
E2fsprogs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds write in the quota file functionality. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/e2fsprogsto a version that resolves this vulnerability.Fixed in 1.45.4-1Fixed in 1.44.5-1+deb10u2Fixed in 1.43.4-2+deb9u1 - Upgrade
Upgrade
debian/e2fsprogsto a version that resolves this vulnerability.Fixed in 1.47.0-2Fixed in 1.47.2-3Fixed in 1.47.4-1