A vulnerability has been discovered in e2fsprogs which can lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/e2fsprogs | * | < 1.46.6 | >= 1.46.6 |
e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems.
Multiple vulnerabilities have been discovered in e2fsprogs. Please review the CVE identifiers referenced below for details.
An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.
There is no known workaround at this time.
All e2fsprogs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.46.6"
A vulnerability in e2fsprogs might allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/e2fsprogs | * | < 1.45.4 | >= 1.45.4 |
e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems.
It was discovered that e2fsprogs incorrectly handled certain ext4 partitions.
A remote attacker could entice a user to process a specially crafted corrupted file system using e2fsck, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All e2fsprogs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.45.4"
A heap-based buffer overflow in e2fsprogs might allow local attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/e2fsprogs | * | < 1.42.12 | >= 1.42.12 |
e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems.
A heap-based buffer overflow was discovered in openfs.c in the libext2fs library in e2fsprogs.
A remote attacker could entice a user to use ext2fs library (for example, fsck) on a specially crafted Ext2/3/4 file system possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All e2fsprogs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.42.12"
A heap-based buffer overflow in e2fsprogs could result in execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/e2fsprogs | * | < 1.42.13 | >= 1.42.13 |
e2fsprogs is a set of utilities for maintaining the ext2, ext3 and ext4 file systems.
e2fsprogs has a heap-based buffer overflow in closefs.c in the libext2fs library.
A local attacker could execute arbitrary code via a specially crafted block group descriptor.
There is no known workaround at this time.
All e2fsprogs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.42.13"
Multiple heap-based buffer overflows in E2fsprogs could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-fs/e2fsprogs | * | < 1.40.3 | >= 1.40.3 |
E2fsprogs provides utilities for use with the ext2 and ext3 file systems including the libext2fs library that allows user-level programs to manipulate an ext2 or ext3 file system.
Rafal Wojtczuk (McAfee AVERT Research) discovered multiple integer overflows in libext2fs, that are triggered when processing information from within the file system, resulting in heap-based buffer overflows.
An attacker could entice a user to process a specially-crafted ext2 or ext3 file system image (with tools linking against libext2fs, e.g. fsck, forensic tools or Xen's pygrub), possibly resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All E2fsprogs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/e2fsprogs-1.40.3"