bugtraq - [SECURITY] [DSA 4257-1] fuse security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1fjQ6B-00077L-Ow@seger.debian.org>
Date: Sat, 28 Jul 2018 14:21:35 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4257-1] fuse security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4257-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 28, 2018                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : fuse
CVE ID         : CVE-2018-10906
Debian Bug     : 904439

Jann Horn discovered that FUSE, a Filesystem in USErspace, allows the
bypass of the 'user_allow_other' restriction when SELinux is active
(including in permissive mode). A local user can take advantage of this
flaw in the fusermount utility to bypass the system configuration and
mount a FUSE filesystem with the 'allow_other' mount option.

For the stable distribution (stretch), this problem has been fixed in
version 2.9.7-1+deb9u1.

We recommend that you upgrade your fuse packages.

For the detailed security status of fuse please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/fuse

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAltcenNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QvRg//W3kUaO9PE7ctcY3CxCa5uej51kqun1Jy7JAw0fjQK84pTH//J8GCJnAs
vbcONxyvrkxlLMRamvRrKU0EfH0vLHkvjcfVY2l5ECPBEISkpVff/MPWCwTplzF9
GMUFdrF+qJNC7EW2y5BfMwkBFn7FYTyEoroSm1AmQjjqncSuzvxIjK8p+P/NVq20
RawwRsEJIquVQQ3ZYE9mnJ9QixYI1+le33bg/FI9eIUy44W43m+OPqmf7kvwH7Qh
SamYcFMvl8uc8reijl2cSoZ1ocCJAr4etJ3M/C0Br/wtQxedk4+bAtYjxxolR101
VBZqh9bnTsBpVnQaMjcBsGsT77IupfCY4nraZQJqcDF9N4712W6MUKckaP933HQa
VKWjlSUqNlIUh2UocONgPWU8yvxtkSHiQIkEEQnuNchNPGGcu+zrdTR3BY/oBIHc
yDgBqk1SV0CNLTzZj/fzDmwaVgzYrE8Dc2+TPok1O8UgnifSlRBmQrLJNxaQE4FL
TDhBB3O+H3laHAFeMPMi92tvr66r/QI5EEhNXBCpauOwYLg32DhL9RJ64FY+mOr6
/YrQMyfX5fI1v/WaqRB4rNgaQROYFaC9uOtSp6UTRa8w2R98JSEUrKuaE/ndVJM+
HtFaaKkequ/hcIARHdiCeya3jZVCOhMgeIJZEcw0G2LntY1z46M=
=MTqc
-----END PGP SIGNATURE-----