CVE-2019-5094: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2019-5094 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 24-09-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse6 products
- e2fsprogs&distro=SUSE Linux Enterprise Desktop 12 SP4< 1.43.8-3.8.1
- e2fsprogs&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.43.8-4.11.1
- e2fsprogs&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.43.8-4.11.1
- e2fsprogs&distro=SUSE Linux Enterprise Server 12 SP4< 1.43.8-3.8.1
- e2fsprogs&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.43.8-3.8.1
Debian2 products
- e2fsprogs< 1.43.4-2+deb9u1 | < 1.44.5-1+deb10u2 | < 1.42.12-2+deb8u1 | < 1.45.4-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Netapp2 products
Alpine1 product
- e2fsprogs≥ 1.43.3, < 1.45.2-r1 | ≥ 1.43.3, < 1.45.4-r0 | ≥ 1.43.3, < 1.43.7-r1 | ≥ 1.43.3, < 1.44.2-r1 | ≥ 1.43.3, < 1.44.5-r1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04
E2fsprogs_project1 product
- e2fsprogs≥ 1.43.3, ≤ 1.45.3
Fedoraproject1 product
- fedoraEOL30 | 31
Mageia1 product
- e2fsprogs< 1.45.4-1.mga7
Ubuntu1 product
- e2fsprogs< 1.42.13-1ubuntu1.1 | < 1.44.1-1ubuntu1.2 | < 1.42.9-3ubuntu1.3+esm1
9 vendors · 16 products
References
26 links
- lists.debian.org/debian-lts-announce/2019/09/msg00029.htmlMailing ListX Refsource MLISTThird Party Advisory
- talosintelligence.com/vulnerability_reports/TALOS-2019-0887X Refsource MISCREPORTExploitThird Party Advisory
