CVE-2019-19816

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4414-1/Third Party Advisory
https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00025.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4414-1/Third Party Advisory

Timeline

Published: Dec 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-198175.5The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-CVE-2019-198185.5The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-CVE-2019-198195.5The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NUL CVE-2019-19825.3A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for AS CVE-2019-198207.8An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve CVE-2019-198218.1A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information a CVE-2019-198227.5A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the co CVE-2019-198237.5A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords CVE-2019-198248.8On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the b CVE-2019-198259.8On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/CVE-2019-198269.8The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_CVE-2019-198295.4A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability t