Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4496 > unrolled thread

Re: [SECURITY] [DSA 3451-1] fuse security update

Started byJason Wallace <jason.wallace@wallacetech.com>
First post2016-01-21 22:20 +0100
Last post2016-01-21 22:50 +0100
Articles 3 — 3 participants

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3451-1] fuse security update Jason Wallace <jason.wallace@wallacetech.com> - 2016-01-21 22:20 +0100
    Re: [SECURITY] [DSA 3451-1] fuse security update Ricardo Palacios <rpalacios@technoactivity.com> - 2016-01-21 22:30 +0100
      Re: [SECURITY] [DSA 3451-1] fuse security update Davide Prina <davide.prina@gmail.com> - 2016-01-21 22:50 +0100

#4496 — Re: [SECURITY] [DSA 3451-1] fuse security update

FromJason Wallace <jason.wallace@wallacetech.com>
Date2016-01-21 22:20 +0100
SubjectRe: [SECURITY] [DSA 3451-1] fuse security update
Message-ID<qTuO5-2vq-1@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

unsubscribe

Jason Wallace

On Thu, Jan 21, 2016 at 12:30 PM, Yves-Alexis Perez <corsac@debian.org>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3451-1                   security@debian.org
> https://www.debian.org/security/                        Yves-Alexis Perez
> January 20, 2016                      https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : fuse
> CVE ID         : CVE-2016-1233
>
> Jann Horn discovered a vulnerability in the fuse (Filesystem in
> Userspace) package in Debian. The fuse package ships an udev rules
> adjusting permissions on the related /dev/cuse character device, making
> it world writable.
>
> This permits a local, unprivileged attacker to create an
> arbitrarily-named character device in /dev and modify the memory of any
> process that opens it and performs an ioctl on it.
>
> This in turn might allow a local, unprivileged attacker to escalate to
> root privileges.
>
> For the oldstable distribution (wheezy), the fuse package is not affected.
>
> For the stable distribution (jessie), this problem has been fixed in
> version 2.9.3-15+deb8u2.
>
> For the testing distribution (stretch), this problem has been fixed
> in version 2.9.5-1.
>
> For the unstable distribution (sid), this problem has been fixed in
> version 2.9.5-1.
>
> We recommend that you upgrade your fuse packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBCgAGBQJWoT/VAAoJEG3bU/KmdcCluUoH/AjfCNv4FhljD2bfLGFWAeIi
> T5frYjGUdUJH9e88t+onHDk37dwN3W00NjXIdU7viV442hFBzNUjn1FAgAfQGEgD
> a5COswLK639PbpI/fUekx6mVVu7u3f4i5iq4YGSj6pyfQtHAcpw3XSNwEovBj/xn
> P4ool1/VcYc0ywJ9RfGo5i8G+gSYoUmEWPUU17BTl7jFD/BukAZ9ddGC5D3Q/M+p
> yMA/IIZPzSc4+SGcXekN8YFP442xBiLywaSw4sajhBfaZnxMm/wqh3rH91cXMSD9
> ohVUrc0fXGFRWaczTg/lnCc+VwoHkwKRJHpY8qWPhh0ec8uP+X/qiQ4qpjB+Sq0=
> =iB9s
> -----END PGP SIGNATURE-----
>
>

[toc] | [next] | [standalone]

#4497

FromRicardo Palacios <rpalacios@technoactivity.com>
Date2016-01-21 22:30 +0100
Message-ID<qTuXN-2zU-29@gated-at.bofh.it>
In reply to#4496

[Multipart message — attachments visible in raw view] — view raw

Unsubscribe
On 21 Jan 2016 22:18, "Jason Wallace" <jason.wallace@wallacetech.com> wrote:

> unsubscribe
>
> Jason Wallace
>
> On Thu, Jan 21, 2016 at 12:30 PM, Yves-Alexis Perez <corsac@debian.org>
> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> -
>> -------------------------------------------------------------------------
>> Debian Security Advisory DSA-3451-1                   security@debian.org
>> https://www.debian.org/security/                        Yves-Alexis Perez
>> January 20, 2016                      https://www.debian.org/security/faq
>> -
>> -------------------------------------------------------------------------
>>
>> Package        : fuse
>> CVE ID         : CVE-2016-1233
>>
>> Jann Horn discovered a vulnerability in the fuse (Filesystem in
>> Userspace) package in Debian. The fuse package ships an udev rules
>> adjusting permissions on the related /dev/cuse character device, making
>> it world writable.
>>
>> This permits a local, unprivileged attacker to create an
>> arbitrarily-named character device in /dev and modify the memory of any
>> process that opens it and performs an ioctl on it.
>>
>> This in turn might allow a local, unprivileged attacker to escalate to
>> root privileges.
>>
>> For the oldstable distribution (wheezy), the fuse package is not affected.
>>
>> For the stable distribution (jessie), this problem has been fixed in
>> version 2.9.3-15+deb8u2.
>>
>> For the testing distribution (stretch), this problem has been fixed
>> in version 2.9.5-1.
>>
>> For the unstable distribution (sid), this problem has been fixed in
>> version 2.9.5-1.
>>
>> We recommend that you upgrade your fuse packages.
>>
>> Further information about Debian Security Advisories, how to apply
>> these updates to your system and frequently asked questions can be
>> found at: https://www.debian.org/security/
>>
>> Mailing list: debian-security-announce@lists.debian.org
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v2
>>
>> iQEcBAEBCgAGBQJWoT/VAAoJEG3bU/KmdcCluUoH/AjfCNv4FhljD2bfLGFWAeIi
>> T5frYjGUdUJH9e88t+onHDk37dwN3W00NjXIdU7viV442hFBzNUjn1FAgAfQGEgD
>> a5COswLK639PbpI/fUekx6mVVu7u3f4i5iq4YGSj6pyfQtHAcpw3XSNwEovBj/xn
>> P4ool1/VcYc0ywJ9RfGo5i8G+gSYoUmEWPUU17BTl7jFD/BukAZ9ddGC5D3Q/M+p
>> yMA/IIZPzSc4+SGcXekN8YFP442xBiLywaSw4sajhBfaZnxMm/wqh3rH91cXMSD9
>> ohVUrc0fXGFRWaczTg/lnCc+VwoHkwKRJHpY8qWPhh0ec8uP+X/qiQ4qpjB+Sq0=
>> =iB9s
>> -----END PGP SIGNATURE-----
>>
>>
>

[toc] | [prev] | [next] | [standalone]

#4498

FromDavide Prina <davide.prina@gmail.com>
Date2016-01-21 22:50 +0100
Message-ID<qTvh7-2He-3@gated-at.bofh.it>
In reply to#4497
On 21/01/2016 22:20, Ricardo Palacios wrote:
> Unsubscribe

You can unsubscribe from this mailing list:

1) with your browser go to this address:
https://www.debian.org/MailingLists/unsubscribe

2) check the "debian-security" and the "debian-security-announce" 
mailing list (note that you must check these exact names)
Note: this because you have reply to a mail sent to two mailing-list

3) put your email address (the one you had used to post here) in the 
bottom edit box with the label "Your E-Mail address:" and press the 
"unsubscribe" button


Alternatively you can go to this web page:
https://lists.debian.org/debian-security/
put your e-mail address and press "unsubscribe" button


If this not work then read this:
https://www.debian.org/MailingLists/#subglitches

Ciao
Davide

-- 
Dizionari: http://linguistico.sourceforge.net/wiki
Perché microsoft continua a compiere azioni illegali?:
http://linguistico.sf.net/wiki/doku.php?id=traduzioni:ms_illegal
GNU/Linux User: 302090: http://counter.li.org
Non autorizzo la memorizzazione del mio indirizzo su outlook

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web