Affected: AlmaLinux:8: e2fsprogs, AlmaLinux:8: e2fsprogs-devel, AlmaLinux:8: e2fsprogs-libs, AlmaLinux:8: libcom_err, AlmaLinux:8: libcom_err-devel, AlmaLinux:8: libss, AlmaLinux:8: libss-devel

The e2fsprogs packages provide a number of utilities for creating, checking, modifying, and correcting the ext2, ext3, and ext4 file systems.

Security Fix(es):

* e2fsprogs: out-of-bounds read/write via crafted filesystem (CVE-2022-1304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn by the publisher.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given. An out-of-bounds hea…

Affected: openEuler:20.03-LTS-SP1: e2fsprogs, openEuler:20.03-LTS-SP3: e2fsprogs, openEuler:22.03-LTS: e2fsprogs

The e2fsprogs package consists of a lot of tools for users to create, check, modify, and correct any inconsistencies in second extended file system. Security Fix(es): An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.(CVE-2022-1304)

e2fsprogs: out-of-bounds read/write via crafted filesystem

e2fsprogs: out-of-bounds read/write via crafted filesystem

Security update for e2fsprogs

Affected: Ubuntu:Pro:14.04:LTS: e2fsprogs, Ubuntu:Pro:16.04:LTS: e2fsprogs, Ubuntu:18.04:LTS: e2fsprogs, Ubuntu:20.04:LTS: e2fsprogs, Ubuntu:22.04:LTS: e2fsprogs

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in E2FSProgs ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Code auszuführen.