Vulnerability in fuseiso - security update
Summary
DSA-3551-1: fuseiso - security update. Affects fuseiso versions < 20070708-3+deb7u1. Fixed in 20070708-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fuseiso is a user-space implementation of the ISO 9660 file system based on FUSE. It allows users to mount ISO 9660 file systems and access their contents. However, several vulnerabilities have been discovered in fuseiso.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-8836, is a stack-based buffer overflow. Attackers who can trick a user into mounting a crafted ISO 9660 file system can cause a denial of service (crash) or potentially execute arbitrary code. The second vulnerability, CVE-2015-8837, is an integer overflow that leads to a heap-based buffer overflow. Similarly, an attacker who can trick a user into mounting a crafted ISO 9660 file system can cause a denial of service (crash) or potentially execute arbitrary code.
How To Fix
Minimum fixed version
20070708-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fuseisoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for these vulnerabilities.
Conclusion
fuseiso is susceptible to two vulnerabilities, CVE-2015-8836 and CVE-2015-8837, which can be exploited by attackers who trick users into mounting crafted ISO 9660 file systems. Upgrading to the recommended versions of fuseiso packages will address these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fuseiso →
FAQ
fuseiso is a user-space implementation of the ISO 9660 file system based on FUSE. It allows users to mount ISO 9660 file systems and access their contents.
CVE-2015-8836 is a stack-based buffer overflow vulnerability in fuseiso. Attackers who can trick a user into mounting a crafted ISO 9660 file system can cause a denial of service (crash) or potentially execute arbitrary code.
CVE-2015-8837 is an integer overflow vulnerability in fuseiso. Attackers who can trick a user into mounting a crafted ISO 9660 file system can cause a denial of service (crash) or potentially execute arbitrary code.
To fix these vulnerabilities, it is recommended to upgrade the fuseiso packages. For the oldstable distribution (wheezy), version 20070708-3+deb7u1 fixes the issues. For the unstable distribution (sid), version 20070708-3.2 includes the necessary fixes.
No specific workaround has been mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for fuseiso.
