CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.

CVSS v2.0 NVD

3.6 LOWAV:L/AC:L/Au:N/C:N/I:P/A:P

EPSS

1.00% chance of exploitation in the next 30 days, 62nd percentile

Published

2015-07-02

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/37089

Security advisories

• http://www.securityfocus.com/bid/74765
• http://www.ubuntu.com/usn/USN-2617-1
• http://www.ubuntu.com/usn/USN-2617-2
• http://www.ubuntu.com/usn/USN-2617-3

References

• CVE Record
• NVD entry