CVE-2019-19767

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197687.5In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to CVE-2019-197696.7In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h CVE-2019-19777.5A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI)CVE-2019-197708.2In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove CVE-2019-197718.8The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In part CVE-2019-197725.4Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are avail CVE-2019-197735.4Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are availabl CVE-2019-197748.8An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails"CVE-2019-197756.1The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.CVE-2019-197778.8stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main.CVE-2019-197788.8An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c.CVE-2019-19785.8A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, an