Out-of-bounds Write

Affecting e2fsprogs package, versions <1.44.5-1+deb10u3

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

References

CVSS Score

6.7
medium severity
  • Attack Vector
    Local
  • Attack Complexity
    Low
  • Privileges Required
    High
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE
CVE-2019-5188
CWE
CWE-787
Snyk ID
SNYK-DEBIAN10-E2FSPROGS-540890
Disclosed
08 Jan, 2020
Published
07 Jan, 2020