CVE-2015-0247 Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
MediumCVSS 4.6
EPSS 0.89%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/e2fsprogs(Debian:12) | < 1.42.12-1 | 1.42.12-1 |
| debian/e2fsprogs(Debian:13) | < 1.42.12-1 | 1.42.12-1 |
| debian/e2fsprogs(Debian:14) | < 1.42.12-1 | 1.42.12-1 |
| e2fsprogs project e2fsprogs | <= 1.42.11 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
References
- Debian Security Tracker CVE-2015-0247 vendor-advisory
- advisories.mageia.org
- git.kernel.org
- FEDORA-2015-1840 vendor-advisory
- FEDORA-2015-2511 vendor-advisory
- FEDORA-2015-2516 vendor-advisory
- SUSE-SU-2015:1103 vendor-advisory
- openSUSE-SU-2015:1006 vendor-advisory
- packetstormsecurity.com
- DSA-3166 vendor-advisory
- MDVSA-2015:045 vendor-advisory
- MDVSA-2015:067 vendor-advisory
- www.ocert.org us-government-resource
- 20150205 [oCERT-2015-002] e2fsprogs input sanitization errors mailing-list
- 72520 vdb-entry
- USN-2507-1 vendor-advisory
- bugzilla.redhat.com
- e2fsprogs-cve20150247-bo(100740) vdb-entry
- GLSA-201701-06 vendor-advisory