Executive Summary

Summary
Title fuseiso security update
Informations
Name DSA-3551 First vendor Publication 2016-04-16
Vendor Debian Last vendor Modification 2016-04-16
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

It was discovered that fuseiso, a user-space implementation of the ISO 9660 file system based on FUSE, contains several vulnerabilities.

CVE-2015-8836

A stack-based buffer overflow may allow attackers who can trick a user into mounting a crafted ISO 9660 file system to cause a denial of service (crash), or, potentially, execute arbitrary code.

CVE-2015-8837

An integer overflow leads to a heap-based buffer overflow, which allows an attacker (who can trick a user into mounting a crafted ISO 9660 file system) to cause a denial of service (crash), or, potentially, execute arbitrary code.

For the oldstable distribution (wheezy), these problems have been fixed in version 20070708-3+deb7u1.

The stable distribution (jessie) does not contain fuseiso packages.

For the unstable distribution (sid), these problems have been fixed in version 20070708-3.2.

We recommend that you upgrade your fuseiso packages.

Original Source

Url : http://www.debian.org/security/2016/dsa-3551

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 2
Os 2

Nessus® Vulnerability Scanner

Date Description
2016-04-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3551.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2016-08-04 09:25:50
  • Multiple Updates
2016-04-19 13:30:03
  • Multiple Updates
2016-04-17 00:24:17
  • First insertion