CVE-2019-11833

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

• CWE-908

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.htmlBroken Link
• http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108372Broken Link, Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2029Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2043Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3309Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3517Third Party Advisory
• https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/
• https://seclists.org/bugtraq/2019/Jun/26Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4068-1/Third Party Advisory
• https://usn.ubuntu.com/4068-2/Third Party Advisory
• https://usn.ubuntu.com/4069-1/Third Party Advisory
• https://usn.ubuntu.com/4069-2/Third Party Advisory
• https://usn.ubuntu.com/4076-1/Third Party Advisory
• https://usn.ubuntu.com/4095-2/Third Party Advisory
• https://usn.ubuntu.com/4118-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4465Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.htmlBroken Link
• http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108372Broken Link, Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2029Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2043Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3309Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3517Third Party Advisory
• https://github.com/torvalds/linux/commit/592acbf16821288ecdc4192c47e3774a4c48bb64Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/06/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJGZIMGB72TL7OGWRMHIL43WHXFQWU4X/
• https://seclists.org/bugtraq/2019/Jun/26Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4068-1/Third Party Advisory
• https://usn.ubuntu.com/4068-2/Third Party Advisory
• https://usn.ubuntu.com/4069-1/Third Party Advisory
• https://usn.ubuntu.com/4069-2/Third Party Advisory
• https://usn.ubuntu.com/4076-1/Third Party Advisory
• https://usn.ubuntu.com/4095-2/Third Party Advisory
• https://usn.ubuntu.com/4118-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4465Third Party Advisory

Published

May 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11828Cross-site scripting (XSS) vulnerability in Chart in Synolog…5.4
• CVE-2019-11829OS command injection vulnerability in drivers_syno_import_us…9.8
• CVE-2019-1183This information is being revised to indicate that this CVE …
• CVE-2019-11830PharMetaDataInterceptor in the PharStreamWrapper (aka phar-s…
• CVE-2019-11831The PharStreamWrapper (aka phar-stream-wrapper) package 2.x …9.8
• CVE-2019-11832TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote c…
• CVE-2019-11834cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11835cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11836The Rediffmail (aka com.rediff.mail.and) application 2.2.6 f…
• CVE-2019-11837njs through 0.3.1, used in NGINX, has a segmentation fault i…
• CVE-2019-11838njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-11839njs through 0.3.1, used in NGINX, has a heap-based buffer ov…