PT-2016-1620 · Fuseiso+1 · Fuseiso+1

Florian Weimer · Published 2016-03-30 · Updated 2025-01-28 · CVE-2015-8837

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FuseISO version 20070708

Description The issue is related to a stack-based buffer overflow in the isofs real readdir function, which can be triggered by a long pathname in an ISO file. This can cause a denial of service, resulting in an application crash, or possibly allow the execution of arbitrary code.

Recommendations For FuseISO version 20070708, consider restricting the use of long pathnames in ISO files to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the isofs real readdir function with potentially malicious ISO files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-3158

ALT-PU-2020-3178

BDU:2016-00921

CVE-2015-8837

DLA-323-1

DSA-3551-1

ROSA-SA-2025-2647

Affected Products

Alt Linux

Fuseiso

References · 27

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=862211 · Exploit
• http://debian.org/security/2016/dsa-3551 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8837 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8837 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3158 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-20 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00921 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-8837 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00922 · Security Note
• https://osv.dev/vulnerability/CVE-2015-8837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8837 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8836 · Security Note
• https://osv.dev/vulnerability/DSA-3551-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8837 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3551-1 · Vendor Advisory