Multiple vulnerabilities have been found in fuseiso, the worst of which could result in the arbitrary execution of code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202007-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: fuseiso: Multiple vulnerabilities Date: July 27, 2020 Bugs: #713328 ID: 202007-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in fuseiso, the worst of which could result in the arbitrary execution of code. Background ========= FuseISO is a FUSE module to mount ISO filesystem images (.iso, .nrg, .bin, .mdf and .img files). Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-fs/fuseiso < 20070708-r3 > = 20070708-r3 Description ========== Multiple vulnerabilities have been discovered in fuseiso. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could entice a user to open a specially crafted ISO file using fuseiso, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All fuseiso users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-fs/fuseiso-20070708-r3" References ========= [ 1 ] CVE-2015-8837 https://nvd.nist.gov/vuln/detail/CVE-2015-8837 Availability =========== This GLSA and any updates to it are available for viewingat the Gentoo Security Website: https://security.gentoo.org/glsa/202007-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
It was discovered that fuseiso, a user-space implementation of the ISO 9660 file system based on FUSE, contains several vulnerabilities. CVE-2015-8836 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3551-1
Get the latest Linux and open source security news straight to your inbox.