CVE-2015-3202

2015-07-0221:59:00

Debian Security Bug Tracker

security-tracker.debian.org

3.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

0.4%

JSON

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount’s debugging feature.

OSVersionArchitecturePackageVersionFilename
Debian12allfuse< 2.9.3-16fuse_2.9.3-16_all.deb
Debian11allfuse< 2.9.3-16fuse_2.9.3-16_all.deb
Debian10allfuse< 2.9.3-16fuse_2.9.3-16_all.deb
Debian999allfuse< 2.9.3-16fuse_2.9.3-16_all.deb
Debian13allfuse< 2.9.3-16fuse_2.9.3-16_all.deb
Debian12allntfs-3g< 1:2014.2.15AR.3-3ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian11allntfs-3g< 1:2014.2.15AR.3-3ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian10allntfs-3g< 1:2014.2.15AR.3-3ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian999allntfs-3g< 1:2014.2.15AR.3-3ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian13allntfs-3g< 1:2014.2.15AR.3-3ntfs-3g_1:2014.2.15AR.3-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	fuse	< 2.9.3-16	fuse_2.9.3-16_all.deb
Debian	11	all	fuse	< 2.9.3-16	fuse_2.9.3-16_all.deb
Debian	10	all	fuse	< 2.9.3-16	fuse_2.9.3-16_all.deb
Debian	999	all	fuse	< 2.9.3-16	fuse_2.9.3-16_all.deb
Debian	13	all	fuse	< 2.9.3-16	fuse_2.9.3-16_all.deb
Debian	12	all	ntfs-3g	< 1:2014.2.15AR.3-3	ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian	11	all	ntfs-3g	< 1:2014.2.15AR.3-3	ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian	10	all	ntfs-3g	< 1:2014.2.15AR.3-3	ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian	999	all	ntfs-3g	< 1:2014.2.15AR.3-3	ntfs-3g_1:2014.2.15AR.3-3_all.deb
Debian	13	all	ntfs-3g	< 1:2014.2.15AR.3-3	ntfs-3g_1:2014.2.15AR.3-3_all.deb