CVE-2015-3202
Fixed in a distro release EPSS 1%
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
Products: debian_linux, fuse_project fuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | fuse | 2.9.3-16 |
| Debian 12 | ntfs-3g | 1:2014.2.15AR.3-3 |
| Debian 13 | fuse | 2.9.3-16 |
| Debian 13 | ntfs-3g | 1:2014.2.15AR.3-3 |
| Debian 14 | ntfs-3g | 1:2014.2.15AR.3-3 |
| Debian 6.0 | fuse | 2.8.4-1.1+deb6u1 |
| Debian 6.0 | ntfs-3g | 1:2010.3.6-1+deb6u1 |
| Debian 6.0 | ntfs-3g | 1:2010.3.6-1+deb6u2 |
| Debian 7 | fuse | 2.9.0-2+deb7u2 |
| Debian 7 | ntfs-3g | 1:2012.1.15AR.5-2.1+deb7u1 |
| Debian 7 | ntfs-3g | 1:2012.1.15AR.5-2.1+deb7u2 |
| Debian 8 | fuse | 2.9.3-15+deb8u1 |
| Debian 8 | ntfs-3g | 1:2014.2.15AR.2-1+deb8u1 |
| Debian 8 | ntfs-3g | 1:2014.2.15AR.2-1+deb8u2 |
| SUSE Linux Enterprise Desktop 12 | fuse | 2.9.3-5.1 |
| SUSE Linux Enterprise Server 12 | fuse | 2.9.3-5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | fuse | 2.9.3-5.1 |
| SUSE Linux Enterprise Software Development Kit 12 | fuse | 2.9.3-5.1 |
| Ubuntu 14.04 LTS | fuse | 2.9.2-4ubuntu4.14.04.1 |
| openSUSE Tumbleweed | fuse | 2.9.5-1.6 |