mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-07-27 07:57:27 +00:00
Code Issues Projects Releases Wiki Activity

fuse: fix for CVE-2015-3202 Privilege Escalation

Browse Source 
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before
invoking (1) mount or (2) umount as root, which allows local users to write
to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is
used by mount's debugging feature.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202
http://www.openwall.com/lists/oss-security/2015/05/21/9

Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Tudor Florea
2015-07-16 16:06:33 +02:00
committed by Armin Kuster
parent e3dbf786b1
commit 7f1df52e94
2 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-filesystems/recipes-support/fuse/fuse_2.9.3.bb
+1
View File
@@ -13,6 +13,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
SRC_URI = "${SOURCEFORGE_MIRROR}/fuse/fuse-${PV}.tar.gz \
file://gold-unversioned-symbol.patch \
file://aarch64.patch \
file://001-fix_exec_environment_for_mount_and_umount.patch \
"
SRC_URI[md5sum] = "33cae22ca50311446400daf8a6255c6a"
SRC_URI[sha256sum] = "0beb83eaf2c5e50730fc553406ef124d77bc02c64854631bdfc86bfd6437391c"