CVE-2019-5094: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• e2fsprogs Project e2fsprogs: from 1.43.3, up to and including 1.45.3
• Fedoraproject Fedora: version 30 only; version 31 only
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified

Published 2019-09-24. Last modified 2026-06-17.