CVE-2015-1572 Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as di...
MediumCVSS 4.6
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/e2fsprogs(Debian:12) | < 1.42.12-1.1 | 1.42.12-1.1 |
| debian/e2fsprogs(Debian:13) | < 1.42.12-1.1 | 1.42.12-1.1 |
| debian/e2fsprogs(Debian:14) | < 1.42.12-1.1 | 1.42.12-1.1 |
| e2fsprogs project e2fsprogs | <= 1.42.11 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
References
- Debian Security Tracker CVE-2015-1572 vendor-advisory
- advisories.mageia.org
- FEDORA-2015-2511 vendor-advisory
- FEDORA-2015-2516 vendor-advisory
- SUSE-SU-2015:1103 vendor-advisory
- openSUSE-SU-2015:1002 vendor-advisory
- openSUSE-SU-2015:1006 vendor-advisory
- DSA-3166 vendor-advisory
- MDVSA-2015:067 vendor-advisory
- MDVSA-2015:068 vendor-advisory
- 72709 vdb-entry
- USN-2507-1 vendor-advisory
- git.kernel.org vendor-advisory
- GLSA-201507-22 vendor-advisory
- bugs.debian.org issue-tracking