CVE-2007-5497: ext2_filesystems_utilities e2fsprogs Numeric Errors

CVSS: 5.8v2.0MediumModified

AliasesRHSA-2008:0003DEBIAN-CVE-2007-5497DSA-1422-1+1 more

Published 07-12-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5497 is a medium (CVSS 5.8) Numeric Errors vulnerability in ext2_filesystems_utilities e2fsprogs. EPSS estimates a 4.11% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

5.8/10

010

Medium · v2.0 (NVD)

EPSS score

4.11%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10731-1

Timeline

07-12-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbitrary code via a crafted filesystem image.

CVSS metrics

1 score · 1 source · 1 version

v2.05.8

EPSS trend

Probability

4.11%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.11% on 20-09-2026

20-09-202620-10-2026

EPSS score

4.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Redhat4 products

e2fsprogs< 0:1.26-1.73 | < 0:1.32-15.4 | < 0:1.35-12.11.el4_6.1 | < 0:1.39-10.el5_1.1
e2fsprogs-debuginfo< 0:1.32-15.4 | < 0:1.35-12.11.el4_6.1 | < 0:1.39-10.el5_1.1
e2fsprogs-devel< 0:1.26-1.73 | < 0:1.32-15.4 | < 0:1.35-12.11.el4_6.1 | < 0:1.39-10.el5_1.1
e2fsprogs-libs< 0:1.39-10.el5_1.1

Debian1 product

e2fsprogs< 1.40.3-1 | < 1.40.2-1+lenny1 | < 1.39+1.40-WIP-2006.11.14+dfsg-2etch1

Ext2_filesystems_utilities1 product

e2fsprogs≤ 1.40.2 | 1.02 | 1.03 | 1.04 | 1.05 | 1.06 | 1.07 | 1.08 | 1.09 | 1.10 | 1.11 | 1.12 | 1.13 | 1.14 | 1.15 | 1.16 | 1.17 | 1.18 | 1.19 | 1.20 | 1.21 | 1.22 | 1.23 | 1.24 | 1.25 | 1.26 | 1.27 | 1.28 | 1.29 | 1.30 | 1.31 | 1.32 | 1.33 | 1.34 | 1.35 | 1.36 | 1.37 | 1.38 | 1.39 | 1.40 | 1.40.1

3 vendors · 6 products

References

44 links

secunia.com/advisories/27965Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1019537VDB EntryX Refsource SECTRACK
www.securityfocus.com/bid/26772VDB EntryX Refsource BID
www.vmware.com/security/advisories/VMSA-2008-0004.htmlX Refsource CONFIRM
secunia.com/advisories/28541Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28000Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/38903VDB EntryX Refsource XF
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10399VDB EntrySignatureX Refsource OVAL
itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083Vendor AdvisoryX Refsource HP
www.redhat.com/support/errata/RHSA-2008-0003.htmlVendor AdvisoryX Refsource REDHAT

Show all 44 references

www.vupen.com/english/advisories/2007/4135VDB EntryX Refsource VUPENVendor Advisory
www.securityfocus.com/archive/1/487999/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/28042Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/489082/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29224Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/archives/fedora-package-announce/2008-January/msg00629.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/40551Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2007/dsa-1422Vendor AdvisoryX Refsource DEBIAN
www.novell.com/linux/security/advisories/2007_25_sr.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/27987Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28030Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/0761VDB EntryX Refsource VUPENVendor Advisory
support.citrix.com/article/CTX118766X Refsource CONFIRM
secunia.com/advisories/27889Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28648Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2010/1796VDB EntryX Refsource VUPENVendor Advisory
www.ubuntu.com/usn/usn-555-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/28360Third Party AdvisoryX Refsource SECUNIAVendor Advisory
sourceforge.net/project/shownotes.php?release_id=560230&group_id=2406X Refsource CONFIRM
secunia.com/advisories/32774Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-2011X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-January/msg00618.htmlVendor AdvisoryX Refsource FEDORA
lists.vmware.com/pipermail/security-announce/2008/000007.htmlMailing ListX Refsource MLIST
support.avaya.com/elmodocs2/security/ASA-2008-040.htmX Refsource CONFIRM
wiki.rpath.com/Advisories:rPSA-2007-0262X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDKSA-2007:242Vendor AdvisoryX Refsource MANDRIVA
access.redhat.com/errata/RHSA-2008:0003Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=403441REPORT
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0003.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-5497REPORT
www.cve.org/CVERecord?id=CVE-2007-5497Advisory
nvd.nist.gov/vuln/detail/CVE-2007-5497Advisory
security-tracker.debian.org/tracker/CVE-2007-5497Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities