An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.5 · e2fsprogs_project, debian, fedoraprojectNVD modified 2026-10-14 07:16
Affected (CPE criteria) 13
cpe:2.3:a:e2fsprogs_project:e2fsprogs:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
References 21
- https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://seclists.org/bugtraq/2019/Sep/58 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-05 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200115-0002/ Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 Exploit, Third Party Advisory
- https://usn.ubuntu.com/4142-1/ Third Party Advisory
- https://usn.ubuntu.com/4142-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4535 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://seclists.org/bugtraq/2019/Sep/58 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-05 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200115-0002/ Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 Exploit, Third Party Advisory
- https://usn.ubuntu.com/4142-1/ Third Party Advisory
- https://usn.ubuntu.com/4142-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4535 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html