Vulnerability in Fuse Project
CVE-2015-3202
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
EPSS: 0.010 (59.5th percentile) — read the EPSS interpretation.
Affected products
- Fuse_project Fuse
- Debian Debian_linux — versions 8.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (Exploit, x_refsource_MISC)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2015-3202?
- CVE-2015-3202 is a vulnerability in Fuse Project, classified under CWE-264. Published 2015-07-02.
- Is CVE-2015-3202 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.