CVE-2019-9755high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.
References
https://www.tuxera.com/community/release-history/
https://access.redhat.com/errata/RHSA-2019:2308
https://access.redhat.com/errata/RHSA-2019:3345
Details
Source: MITRE
Published: 2019-06-05
Updated: 2021-07-21
Type: CWE-191
Risk Information
CVSS v2
Base Score: 4.4
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.4
Severity: MEDIUM
CVSS v3
Base Score: 7
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1
Severity: HIGH
Vulnerable Software
Configuration 1
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 153195 | openSUSE 15 Security Update : ntfs-3g_ntfsprogs (openSUSE-SU-2021:1244-1) | Nessus | SuSE Local Security Checks | high |
| 153124 | SUSE SLED12 / SLES12 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2021:2965-1) | Nessus | SuSE Local Security Checks | high |
| 153122 | SUSE SLED15 / SLES15 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2021:2971-1) | Nessus | SuSE Local Security Checks | high |
| 153117 | openSUSE 15 Security Update : ntfs-3g_ntfsprogs (openSUSE-SU-2021:2971-1) | Nessus | SuSE Local Security Checks | high |
| 145576 | CentOS 8 : virt:rhel (CESA-2019:3345) | Nessus | CentOS Local Security Checks | high |
| 141945 | Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522) | Nessus | Amazon Linux Local Security Checks | high |
| 139146 | EulerOS 2.0 SP8 : ntfs-3g (EulerOS-SA-2020-1816) | Nessus | Huawei Local Security Checks | high |
| 138968 | GLSA-202007-45 : NTFS-3G: Remote code execution, possible privilege escalation | Nessus | Gentoo Local Security Checks | high |
| 137464 | EulerOS 2.0 SP2 : libguestfs-winsupport (EulerOS-SA-2020-1622) | Nessus | Huawei Local Security Checks | high |
| 130835 | EulerOS 2.0 SP5 : libguestfs-winsupport (EulerOS-SA-2019-2126) | Nessus | Huawei Local Security Checks | high |
| 130715 | EulerOS 2.0 SP3 : libguestfs-winsupport (EulerOS-SA-2019-2253) | Nessus | Huawei Local Security Checks | high |
| 130529 | RHEL 8 : virt:rhel (RHSA-2019:3345) | Nessus | Red Hat Local Security Checks | high |
| 128389 | CentOS 7 : libguestfs-winsupport (CESA-2019:2308) | Nessus | CentOS Local Security Checks | high |
| 128230 | Scientific Linux Security Update : libguestfs-winsupport on SL7.x x86_64 (20190806) | Nessus | Scientific Linux Local Security Checks | high |
| 127711 | RHEL 7 : libguestfs-winsupport (RHSA-2019:2308) | Nessus | Red Hat Local Security Checks | high |
| 124583 | openSUSE Security Update : ntfs-3g_ntfsprogs (openSUSE-2019-1314) | Nessus | SuSE Local Security Checks | high |
| 124582 | openSUSE Security Update : ntfs-3g_ntfsprogs (openSUSE-2019-1313) | Nessus | SuSE Local Security Checks | high |
| 124548 | Fedora 30 : 2:ntfs-3g (2019-e42442fb33) | Nessus | Fedora Local Security Checks | high |
| 124294 | SUSE SLED15 / SLES15 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2019:1001-1) | Nessus | SuSE Local Security Checks | high |
| 124293 | SUSE SLED12 Security Update : ntfs-3g_ntfsprogs (SUSE-SU-2019:1000-1) | Nessus | SuSE Local Security Checks | high |
| 123765 | Fedora 28 : 2:ntfs-3g (2019-c1e6c6edd9) | Nessus | Fedora Local Security Checks | high |
| 123695 | Fedora 29 : 2:ntfs-3g (2019-e396eacd61) | Nessus | Fedora Local Security Checks | high |
| 123023 | Debian DSA-4413-1 : ntfs-3g - security update | Nessus | Debian Local Security Checks | high |
| 123018 | Debian DLA-1724-1 : ntfs-3g security update | Nessus | Debian Local Security Checks | high |