SB2015022806 - Ubuntu update for fuse
Published: February 28, 2015 Updated: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Link following (CVE-ID: CVE-2011-0541)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-0542)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-0543)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.
Remediation
Install update from vendor's website.