CVE-2016-1233

Name of the Vulnerable Software and Affected Versions fuse versions prior to 2.9.3-15+deb8u2 in jessie fuse versions prior to 2.9.5-1 in stretch fuse versions prior to 2.9.5-1 in sid

Description The issue is related to an unspecified udev rule in the Debian fuse package that sets world-writable permissions for the /dev/cuse character device. This allows local users to gain privileges via a character device in /dev. The issue is related to an ioctl.

Recommendations For fuse versions prior to 2.9.3-15+deb8u2 in jessie, update to version 2.9.3-15+deb8u2 or later. For fuse versions prior to 2.9.5-1 in stretch, update to version 2.9.5-1 or later. For fuse versions prior to 2.9.5-1 in sid, update to version 2.9.5-1 or later.