Published: 17/02/2015 Updated: 09/10/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs prior to 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
e2fsprogs project e2fsprogs
debian debian linux 7.0
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 14.10
canonical ubuntu linux 10.04
fedoraproject fedora 20
fedoraproject fedora 21

Debian Bug report logs - #778948 e2fsprogs: CVE-2015-1572 buffer overflow Package: src:e2fsprogs; Maintainer for src:e2fsprogs is Theodore Y Ts'o <tytso@mitedu>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Sun, 22 Feb 2015 01:51:01 UTC Severity: serious Tags: patch, security Fixed in versions e2fsprog ...

e2fsprogs could be made to crash or run programs as an administrator if it processed a specially crafted filesystem image ...

A heap-based buffer overflow flaw was found in e2fsprogs A specially crafted Ext2/3/4 file system could cause an application using the ext2fs library (for example, fsck) to crash or, possibly, execute arbitrary code ...

CWE-119 http://www.securityfocus.com/bid/72520 http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:045 https://bugzilla.redhat.com/show_bug.cgi?id=1187032 http://www.ocert.org/advisories/ocert-2015-002.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html http://www.debian.org/security/2015/dsa-3166 http://www.ubuntu.com/usn/USN-2507-1 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:067 http://advisories.mageia.org/MGASA-2015-0061.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html https://security.gentoo.org/glsa/201701-06 https://exchange.xforce.ibmcloud.com/vulnerabilities/100740 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html http://www.securityfocus.com/archive/1/534633/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778948 https://usn.ubuntu.com/2507-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-0247

CVE-2015-0247

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect