Vulnerability CVE-2019-9755: Information

Description

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

Severity: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-9755
Published: June 5, 2019
Modified: April 26, 2022
Error type identifier: CWE-787, CWE-191

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
ntfs-3gsisyphus2017.3.23-alt32022.10.3-alt1ALT-PU-2020-3107-1260249Fixed
ntfs-3gp102021.8.22-alt12021.8.22-alt2ALT-PU-2021-2730-1284294Fixed
ntfs-3gp92021.8.22-alt12021.8.22-alt2ALT-PU-2021-2767-1284295Fixed
ntfs-3gc10f12021.8.22-alt12021.8.22-alt2ALT-PU-2021-2730-1284294Fixed
ntfs-3gc9f22021.8.22-alt12021.8.22-alt2ALT-PU-2022-2244-1303526Fixed
ntfs-3gp112017.3.23-alt32022.10.3-alt1ALT-PU-2020-3107-1260249Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.tuxera.com/community/release-history/
  • Release Notes
  • Vendor Advisory
RHSA-2019:2308
  • Third Party Advisory
RHSA-2019:3345
  • Third Party Advisory
RHBA-2019:3723
  • Third Party Advisory
GLSA-202007-45
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:tuxera:ntfs-3g:2017.3.23:*:*:*:*:*:*:*

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top