Hi all, On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel <mike.gabr...@das-netzwerkteam.de> wrote: > On Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote: >> On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote: >>> Source: fuse >>> Version: 2.8.4-1.1+deb6u1 >> >> there was no DLA for this upload, could you please prepare one and send it >> to >> the list?! Thanks already. You mean to debian-lts-announce, right?
> Let me know if you need a hand with this. Please review the following, I'm open for suggestions. -- cut -- Subject: [DLA 238-1] fuse security update Package : fuse Version : 2.8.4-1.1+deb6u1 CVE ID : CVE-2015-3202 Debian Bug : #786439 Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users. For the old-oldstable distribution (squeeze-lts), this problem has been fixed in version 2.8.4-1.1+deb6u1. We recommend that you upgrade your fuse packages. -- cut -- Thanks, Laszlo/GCS -- To UNSUBSCRIBE, email to debian-lts-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/cakjshr3owzzwcx6tylztua+9pzqq5qgabjq2th66qdmoj8h...@mail.gmail.com
