CVE-2019-9755
published 2019-06-05CVE-2019-9755: An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted…
high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ntfs-3g | < ntfs-3g 1:2017.3.23AR.3-3 (bookworm) | ntfs-3g 1:2017.3.23AR.3-3 (bookworm) |
| msrc | cbl2_ntfs-3g_2017.3.23-15_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| tuxera | ntfs-3g | — | — |
| tuxera | ntfs-3g | >= 0 < 1:2017.3.23AR.3-3 | 1:2017.3.23AR.3-3 |
| tuxera | ntfs-3g | >= 0 < 1:2017.3.23AR.3-3 | 1:2017.3.23AR.3-3 |
| tuxera | ntfs-3g | >= 0 < 1:2017.3.23AR.3-3 | 1:2017.3.23AR.3-3 |
| tuxera | ntfs-3g | >= 0 < 1:2017.3.23AR.3-3 | 1:2017.3.23AR.3-3 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH