Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:3260-1

Опубликовано: 19 окт. 2018
Источник: suse-cvrf

Описание

Security update for fuse

This update for fuse fixes the following issues:

  • CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects (bsc#1101797)

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15
fuse-2.9.7-3.3.1
fuse-devel-2.9.7-3.3.1
fuse-doc-2.9.7-3.3.1
libfuse2-2.9.7-3.3.1
libulockmgr1-2.9.7-3.3.1

Ссылки

Описание

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.

Затронутые продукты
SUSE Linux Enterprise Module for Basesystem 15:fuse-2.9.7-3.3.1
SUSE Linux Enterprise Module for Basesystem 15:fuse-devel-2.9.7-3.3.1
SUSE Linux Enterprise Module for Basesystem 15:fuse-doc-2.9.7-3.3.1
SUSE Linux Enterprise Module for Basesystem 15:libfuse2-2.9.7-3.3.1
Ссылки