Every CVE Search/ Get API key

CVE-2019-5094

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1...

7.5 HighFix available

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.10%Down 2.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-787
Updated
2026-11-02
EUVDEUVD-2019-14699 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
EUVD-2019-14699
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3498-94v2-7qqw 6.7

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1...

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
GHSA-3498-94v2-7qqw
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-5094 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
ALPINE-CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-5094 7.5

CVE-2019-5094 does not affect BellSoft software

Record
BELL-CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-5094 7.5

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
DEBIAN-CVE-2019-5094
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:1913 7.5

Red Hat Security Advisory: e2fsprogs security, bug fix, and enhancement update

Record
RHSA-2020:1913
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4011 7.5

Red Hat Security Advisory: e2fsprogs security and bug fix update

Record
RHSA-2020:4011
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-5094 6.7

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Record
UBUNTU-CVE-2019-5094
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0296 No score

Updated e2fsprogs packages fix security vulnerability

Updated e2fsprogs packages fix security vulnerability:

Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code (CVE-2019-5094).

The e2fsprogs package has been updated to version 1.45.4, fixing this issue and other bugs. See the upstream release notes for details.

Record
MGASA-2019-0296
Updated
2026-11-02
OSVopenSUSE-SU-2024:10731-1 No score

e2fsprogs-1.46.4-1.1 on GA media

These are all security issues fixed in the e2fsprogs-1.46.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10731-1
Updated
2026-11-02
OSVSUSE-RU-2019:2676-1 No score

Recommended update for e2fsprogs

This update for e2fsprogs fixes the following issues:

Security issue fixed:

  • CVE-2019-5094: Fixed an arbitrary code execution via specially crafted ext4 file systems. (bsc#1152101)

Non-security issue fixed:

  • libext2fs: Call fsync(2) to clear stale errors for a new a unix I/O channel. (bsc#1145716)
Record
SUSE-RU-2019:2676-1
Updated
2026-11-02
OSVSUSE-RU-2019:2677-1 No score

Recommended update for e2fsprogs

This update for e2fsprogs fixes the following issues:

Security issue fixed:

  • CVE-2019-5094: Fixed an arbitrary code execution via specially crafted ext4 file systems. (bsc#1152101)

Non-security issue fixed:

  • libext2fs: Call fsync(2) to clear stale errors for a new a unix I/O channel. (bsc#1145716)
Record
SUSE-RU-2019:2677-1
Updated
2026-11-02
OSVUSN-4142-1 No score

e2fsprogs vulnerability

It was discovered that e2fsprogs incorrectly handled certain ext4 partitions. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-4142-1
Updated
2026-11-02
OSVUSN-4142-2 No score

e2fsprogs vulnerability

USN-4142-1 fixed a vulnerability in e2fsprogs. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that e2fsprogs incorrectly handled certain ext4 partitions. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-4142-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
e2fsprogs
Alpine:v3.10
 1.43.3 up to 1.45.2-r1
1.45.2-r1
e2fsprogs
Alpine:v3.11
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.12
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.13
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.14
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.15
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.16
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.17
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.18
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.19
 1.43.3 up to 1.45.4-r0
1.45.4-r0
Show 72 moreShow less
Affected packages
PackageAffectedFixed
e2fsprogs
Alpine:v3.20
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.21
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.22
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.23
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.24
 1.43.3 up to 1.45.4-r0
1.45.4-r0
e2fsprogs
Alpine:v3.7
 1.43.3 up to 1.43.7-r1
1.43.7-r1
e2fsprogs
Alpine:v3.8
 1.43.3 up to 1.44.2-r1
1.44.2-r1
e2fsprogs
Alpine:v3.9
 1.43.3 up to 1.44.5-r1
1.44.5-r1
e2fsprogs
Debian:12
 before 1.45.4-1
1.45.4-1
e2fsprogs
Debian:13
 before 1.45.4-1
1.45.4-1
e2fsprogs
Debian:14
 before 1.45.4-1
1.45.4-1
e2fsprogs
Debian:8
 before 1.42.12-2+deb8u1, plus listed versions
1.42.12-1.11.42.12-2
1.42.12-2+deb8u1
e2fsprogs
Debian:9
 before 1.43.4-2+deb9u1, plus listed versions
1.43.4-2
1.43.4-2+deb9u1
e2fsprogs
Debian:10
 before 1.44.5-1+deb10u2, plus listed versions
1.44.5-11.44.5-1+deb10u1
1.44.5-1+deb10u2
e2fsprogs
Mageia:7
 before 1.45.4-1.mga7
1.45.4-1.mga7
e2fsprogs
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs-libs
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
libcom_err
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
libcom_err-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
libcom_err-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
libss
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
libss-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:1.45.4-3.el8
0:1.45.4-3.el8
e2fsprogs
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-static
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-static
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-static
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libcom_err-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs-static
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
libss-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:1.42.9-19.el7
0:1.42.9-19.el7
e2fsprogs
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.43.8-4.11.1
1.43.8-4.11.1
e2fsprogs
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 1.43.8-4.11.1
1.43.8-4.11.1
e2fsprogs
SUSE:Linux Enterprise Desktop 12 SP4
 before 1.43.8-3.8.1
1.43.8-3.8.1
e2fsprogs
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 1.43.8-3.8.1
1.43.8-3.8.1
e2fsprogs
SUSE:Linux Enterprise Server 12 SP4
 before 1.43.8-3.8.1
1.43.8-3.8.1
e2fsprogs
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.43.8-3.8.1
1.43.8-3.8.1
e2fsprogs
Ubuntu:Pro:14.04:LTS
 before 1.42.9-3ubuntu1.3+esm1, plus listed versions
1.42.8-1ubuntu11.42.8-1ubuntu21.42.8-1ubuntu31.42.9-2ubuntu11.42.9-3ubuntu11.42.9-3ubuntu1.21.42.9-3ubuntu1.3
1.42.9-3ubuntu1.3+esm1
e2fsprogs
Ubuntu:16.04:LTS
 before 1.42.13-1ubuntu1.1, plus listed versions
1.42.12-1ubuntu21.42.13-1ubuntu1
1.42.13-1ubuntu1.1
e2fsprogs
Ubuntu:18.04:LTS
 before 1.44.1-1ubuntu1.2, plus listed versions
1.43.5-11.43.7-11.43.8-1ubuntu11.43.8-21.43.9-1
Show 6 moreShow less
1.43.9-1ubuntu11.43.9-21.44.0-11.44.1-11.44.1-1ubuntu11.44.1-1ubuntu1.1
1.44.1-1ubuntu1.2
e2fsprogs
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.46.4-1.1
1.46.4-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-5094 is a high vulnerability (CVSS 7.5) in E2fsprogs Project E2fsprogs, published September 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in e2fsprogs 1.45.2-r1.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open