==========================================================================
Ubuntu Security Notice USN-4249-1
January 23, 2020

e2fsprogs vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.10
– Ubuntu 19.04
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
– Ubuntu 14.04 ESM
– Ubuntu 12.04 ESM

Summary:

e2fsprogs could be made to execute arbitrary code if it was running
in a crafted ext4 partition.

Software Description:
– e2fsprogs: ext2/ext3/ext4 file system utilities

Details:

It was discovered that e2fsprogs incorrectly handled certain ext4 partitions.
An attacker could possibly use this issue to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
e2fsprogs 1.45.3-4ubuntu2.1

Ubuntu 19.04:
e2fsprogs 1.44.6-1ubuntu0.2

Ubuntu 18.04 LTS:
e2fsprogs 1.44.1-1ubuntu1.3

Ubuntu 16.04 LTS:
e2fsprogs 1.42.13-1ubuntu1.2

Ubuntu 14.04 ESM:
e2fsprogs 1.42.9-3ubuntu1.3+esm2

Ubuntu 12.04 ESM:
e2fsprogs 1.42-1ubuntu2.5

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4249-1
CVE-2019-5188

Package Information:
https://launchpad.net/ubuntu/+source/e2fsprogs/1.45.3-4ubuntu2.1
https://launchpad.net/ubuntu/+source/e2fsprogs/1.44.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/e2fsprogs/1.44.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/e2fsprogs/1.42.13-1ubuntu1.2
—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAl4pp1QACgkQRbznW4QL
H2nVlg/+PyhjQoQeKPBt+FZmaVZKj4fIEZmTPmMtC/8sEnZn5ls2D9Q+8hG91Leg
zn/GMN0Z0VXly3BcqXvr+YD1Lqj0gGZq58QFKy5QNd/WN5uW+zbV5zXeZVPW4ADQ
Kt9zV/NMV43zTojSEtYsgwFGSxWWUEu0BHwBgxr3xQt0N1wIImIHXmHwe1HP203u
R9GYofiyCpTLgRZmz5Exn+gR8kHMyOIIHkLz9nb9mGPGInKTlilCTzvu6ONm5nV2
8RUIEERWOzDaE1Ce9gOtR+2dZ3kV3Bu3lebsWDKU4Fml6Gq7QRo1LyBcpjgVsXWA
QPlYekgWeO47aoNHNV1Sztxa/G2l6378mWKng6EZ1/aGEiiSVHw8sKfrgXugb5ZR
tOYxkqDavr/ckrK+r4bheOxL2ZXoFhITjhuZI1mYLuyTN3yjJmxu7t0Es0r/NmOt
iETd4hk5FXu+PYvk1eTQIZG1RE4h6Y78uwNBhVBMvdYk8FsWALS7AukcqhTxo7L3
aHNTxXDF+gz5+yGVaVSed4YWDWMVYpYxXHqZtfPAUKJZQWu6aGueGADV7fDVx+a2
6SNKgOhiovbP32ElsuB+smlRFDKoBo8zVw6lAYzuWFMkIw/PdH0dXJ2sQWU0gbVl
aX1UkRtfqpVkdZfPEaHoCxVvw3VM39/FpuEvJV8jzTDtMP6WRpE=
=UpEP
—–END PGP SIGNATURE—–
—