Univention Bugzilla – Bug 47498
fuse: Multiple issues (4.3)
Last modified: 2018-08-15 13:14:44 CEST
New Debian fuse 2.9.7-1+deb9u1 fixes: This update addresses the following issue(s): * * In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects. (CVE-2018-10906) 2.9.7-1+deb9u1 (Thu, 26 Jul 2018 08:39:27 +0200) * Non-maintainer upload by the Security Team. * Restriction bypass of the "allow_other" option when SELinux is active (CVE-2018-10906) * CVE-2018-10906 fuse: bypass of the "user_allow_other" restriction when SELinux is active (CVE-2018-10906)
--- mirror/ftp/4.3/unmaintained/4.3-0/source/fuse_2.9.7-1.dsc +++ apt/ucs_4.3-0-errata4.3-1/source/fuse_2.9.7-1+deb9u1.dsc @@ -1,3 +1,9 @@ +2.9.7-1+deb9u1 [Thu, 26 Jul 2018 08:39:27 +0200] Salvatore Bonaccorso <carnil@debian.org>: + + * Non-maintainer upload by the Security Team. + * Restriction bypass of the "allow_other" option when SELinux is active + (CVE-2018-10906) (Closes: #904439) + 2.9.7-1 [Thu, 23 Jun 2016 16:15:37 +0000] Laszlo Boszormenyi (GCS) <gcs@debian.org>: * New upstream release. <http://10.200.17.11/4.3-1/#6436954727505840065>
OK: patches OK: piuparts OK: yaml OK: errata-announce fuse.yaml [4.3-1] 0e1564f14c Bug #47498: fuse 2.9.7-1+deb9u1 doc/errata/staging/fuse.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+)
<http://errata.software-univention.de/ucs/4.3/179.html>