fuseiso: Multiple vulnerabilities — GLSA 202007-20

Multiple vulnerabilities have been found in fuseiso, the worst of which could result in the arbitrary execution of code.

Affected packages

Package	sys-fs/fuseiso on all architectures
Affected versions	< 20070708-r3
Unaffected versions	>= 20070708-r3

Background

FuseISO is a FUSE module to mount ISO filesystem images (.iso, .nrg, .bin, .mdf and .img files).

Description

Multiple vulnerabilities have been discovered in fuseiso. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted ISO file using fuseiso, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All fuseiso users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-fs/fuseiso-20070708-r3"

References

CVE-2015-8837

Release date
July 27, 2020

Latest revision
July 27, 2020: 1

Severity
normal

Exploitable
remote

Bugzilla entries

713328