FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-19 20:48:44 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
0f488b7b-bbb9-11e4-903c-080027ef73ec	e2fsprogs -- buffer overflow if s_first_meta_bg too big Theodore Ts'o reports: If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors. The finding is credited to a vulnerability report from Jose Duart of Google Security Team and was reported through oCERT-2015-002. Discovery 2014-08-09 Entry 2015-02-24 e2fsprogs < 1.42.12 http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 http://www.ocert.org/advisories/ocert-2015-002.html https://bugzilla.redhat.com/show_bug.cgi?id=1187032 CVE-2015-0247
299e3f81-aee7-11dc-b781-0016179b2dd5	e2fsprogs -- heap buffer overflow Theodore Y. Ts'o reports: Fix a potential security vulnerability where an untrusted filesystem can be corrupted in such a way that a program using libext2fs will allocate a buffer which is far too small. This can lead to either a crash or potentially a heap-based buffer overflow crash. No known exploits exist, but main concern is where an untrusted user who possesses privileged access in a guest Xen environment could corrupt a filesystem which is then accessed by thus allowing the untrusted user to gain privileged access in the host OS. Thanks to the McAfee AVERT Research group for reporting this issue. Discovery 2007-12-07 Entry 2007-12-20 e2fsprogs < 1.40.3 26772 CVE-2007-5497 http://secunia.com/advisories/27889/ http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230
2a4bcd7d-bbb8-11e4-903c-080027ef73ec	e2fsprogs -- potential buffer overflow in closefs() Theodore Ts'o reports: On a carefully crafted filesystem that gets modified through tune2fs or debugfs, it is possible to trigger a buffer overrun when the file system is closed via closefs(). Discovery 2015-02-06 Entry 2015-02-24 e2fsprogs < 1.42.12_2 http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73 CVE-2015-1572
2aa9967c-27e0-11e8-9ae1-080027ac955c	e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program Theodore Y. Ts'o reports: Fixed some potential buffer overrun bugs in the blkid library and in the fsck program. Discovery 2018-03-07 Entry 2018-03-14 e2fsprogs < 1.44.0 e2fsprogs-libblkid < 1.44.0 http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0
8b61308b-322a-11ea-b34b-1de6fb24355d	e2fsprogs -- rehash.c/pass 3a mutate_name() code execution vulnerability Lilith of Cisco Talos reports: A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Theodore Y. Ts'o reports: E2fsprogs 1.45.5 [...:] Fix a potential out of bounds write when checking a maliciously corrupted file system. This is probably not exploitable on 64-bit platforms, but may be exploitable on 32-bit binaries depending on how the compiler lays out the stack variables. (Addresses CVE-2019-5188) Discovery 2019-12-18 Entry 2020-01-08 e2fsprogs < 1.45.5 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973 http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5 CVE-2019-5188
a58f3fde-e4e0-11ec-8340-2d623369b8b5	e2fsprogs -- out-of-bounds read/write vulnerability Nils Bars reports: During the processing of [a specially fuzzed disk image], an out-of-bounds write is triggered and causes a segmentation fault (SIGSEGV). Discovery 2022-03-24 Entry 2022-06-05 e2fsprogs < 1.46.5_1 e2fsprogs-nobootfsck < 1.46.5_1 e2fsprogs-roothardlinks < 1.46.5_1 CVE-2022-1304 https://bugzilla.redhat.com/show_bug.cgi?id=2068113 https://bugzilla.redhat.com/show_bug.cgi?id=2069726 https://lore.kernel.org/linux-ext4/20220421173148.20193-1-lczerner@redhat.com/T/#u
ad3451b9-23e0-11ea-8b36-f1925a339a82	e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck Ted Y. Ts'o reports: A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. Discovery 2019-09-23 Entry 2019-12-21 e2fsprogs < 1.45.4 http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4 CVE-2019-5094