PT-2016-1621 · Fuseiso+1 · Fuseiso+1

Florian Weimer · Published 2016-03-30 · Updated 2025-01-28 · CVE-2015-8836

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FuseISO version 20070708

Description The issue is caused by an integer overflow in the isofs real read zf function, which can lead to a heap-based buffer overflow when a large ZF block size is encountered in an ISO file. This could allow remote attackers to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts.

Recommendations For FuseISO version 20070708, consider avoiding the use of large ZF block sizes in ISO files until a patch is available. As a temporary workaround, restrict access to ISO files with potentially large ZF block sizes to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-3158

ALT-PU-2020-3178

BDU:2016-00922

CVE-2015-8836

DLA-323-1

DSA-3551-1

ROSA-SA-2025-2647

Affected Products

Alt Linux

Fuseiso

References · 26

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=861358 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8836 · Security Note
• http://debian.org/security/2016/dsa-3551 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8836 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8837 · Security Note
• https://errata.altlinux.org/ALT-PU-2020-3158 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8836 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00921 · Security Note
• https://bdu.fstec.ru/vul/2016-00922 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8837 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8836 · Security Note
• https://osv.dev/vulnerability/DSA-3551-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3551-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8836 · Vendor Advisory