PT-2015-7931 · Filesystem In Userspace · Fuseiso

Published 2015-10-25 · Updated 2015-10-25

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FuseISO (affected versions not specified)

Description The issue involves two flaws in FuseISO, a FUSE module for mounting ISO filesystem images. An integer overflow leads to a heap-based buffer overflow when reading certain ZF blocks of particular inodes, potentially causing the fuseiso binary to crash. Additionally, a stack-based buffer overflow occurs when expanding directory portions for absolute path filename entries, which could result in the fuseiso binary crashing or potentially executing arbitrary code with the privileges of the user running the fuseiso executable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2015-0406

Affected Products

Fuseiso

References · 4

• https://advisories.mageia.org/MGASA-2015-0406.html · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0406 · Vendor Advisory
• http://lwn.net/Alerts/658923 · Note
• https://bugs.mageia.org/show_bug.cgi?id=16872 · Note