CVE-2007-5191 json
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return value…
published 2007-10-04 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5172
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.
Patch / fix
- util-linux Debian 14, Debian 13, Debian 12 2.13-8
debian advisories DEBIAN-CVE-2007-5191
- util-linux RHEL 3 2.11y-31.24
- util-linux RHEL 4 2.12a-17.el4_6.1
- util-linux RHEL 5 2.13-0.45.el5_1.1
- mount RHEL 3 2.11y-31.24
- losetup RHEL 3 2.11y-31.24
red hat advisories RHSA-2007:0969
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2007-5191 updated
util-linux (u)mount doesn't drop privileges properly when calling helpers
-
Red Hat Desktop version 3 mount 2.11y-31.24, losetup 2.11y-31.24, util-linux 2.11y-31.24 Red Hat Enterprise Linux (v. 5 server) util-linux 2.13-0.45.el5_1.1 Red Hat Enterprise Linux AS version 3 mount 2.11y-31.24, losetup 2.11y-31.24, util-linux 2.11y-31.24 Red Hat Enterprise Linux AS version 4 util-linux 2.12a-17.el4_6.1 Red Hat Enterprise Linux Desktop (v. 5 client) util-linux 2.13-0.45.el5_1.1 Red Hat Enterprise Linux Desktop version 4 util-linux 2.12a-17.el4_6.1fixed: vendor fix RHSA-2007:0969
+4 more productsfewer
Red Hat Enterprise Linux ES version 3 mount 2.11y-31.24, losetup 2.11y-31.24, util-linux 2.11y-31.24 Red Hat Enterprise Linux ES version 4 util-linux 2.12a-17.el4_6.1 Red Hat Enterprise Linux WS version 3 mount 2.11y-31.24, losetup 2.11y-31.24, util-linux 2.11y-31.24 Red Hat Enterprise Linux WS version 4 util-linux 2.12a-17.el4_6.1
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-252 Unchecked Return Value
References
-
ubuntu.com
/usn/usn-533-1
vendor-advisory, third-party-advisory
-
frontal2.mandriva.com
/en/security/advisories?name=MDKSA-2007:198
vendor-advisory, third-party-advisory
-
debian.org
/security/2008/dsa-1449
vendor-advisory, third-party-advisory
-
debian.org
/security/2008/dsa-1450
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/glsa-200710-18.xml
vendor-advisory, third-party-advisory
-
redhat.com
/archives/fedora-package-announce/2007-October/msg00144.html
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2007-0969.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2007-10/msg00008.html
vendor-advisory, mailing-list, third-party-advisory
-
issues.rpath.com
/browse/RPL-1757
broken-link
-
secunia.com
/advisories/27145
third-party-advisory
-
bugs.gentoo.org
/show_bug.cgi?id=195390
issue-tracking, third-party-advisory
-
secunia.com
/advisories/27122
third-party-advisory
- git.kernel.org /?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=ebbeb2c7ac1b00b6083905957837a271e80b187e
-
secunia.com
/advisories/28349
third-party-advisory
-
secunia.com
/advisories/27104
third-party-advisory
-
secunia.com
/advisories/27283
third-party-advisory
-
securityfocus.com
/archive/1/485936/100/0/threaded
mailing-list, third-party-advisory, vdb-entry
-
secunia.com
/advisories/27354
third-party-advisory
-
lists.vmware.com
/pipermail/security-announce/2008/000002.html
mailing-list, third-party-advisory
-
secunia.com
/advisories/28469
third-party-advisory
-
secunia.com
/advisories/28348
third-party-advisory
-
securitytracker.com
/id?1018782
vdb-entry, third-party-advisory
-
secunia.com
/advisories/27687
third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=320041
issue-tracking, third-party-advisory
-
secunia.com
/advisories/28368
third-party-advisory
-
secunia.com
/advisories/27399
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10101
vdb-entry, signature, third-party-advisory
-
securityfocus.com
/bid/25973
vdb-entry, third-party-advisory
-
secunia.com
/advisories/27188
third-party-advisory
-
support.avaya.com
/elmodocs2/security/ASA-2008-023.htm
third-party-advisory
-
vupen.com
/english/advisories/2007/3417
vdb-entry, third-party-advisory
-
vmware.com
/security/advisories/VMSA-2008-0001.html
third-party-advisory
-
vupen.com
/english/advisories/2008/0064
vdb-entry, third-party-advisory
-
securityfocus.com
/archive/1/486859/100/0/threaded
mailing-list, third-party-advisory, vdb-entry
Sources
- CVE List CVE-2007-5191
- NVD CVE-2007-5191
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.