CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
0.4%
Package : ntfs-3g
Version : 1:2010.3.6-1+deb6u1
CVE ID : CVE-2015-3202
Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for
FUSE, does not scrub the environment before executing mount or umount
with elevated privileges. A local user can take advantage of this flaw
to overwrite arbitrary files and gain elevated privileges by accessing
debugging features via the environment that would not normally be safe
for unprivileged users.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | s390x | ntfs-3g-udeb | < 1:2012.1.15AR.5-2.1+deb7u2 | ntfs-3g-udeb_1:2012.1.15AR.5-2.1+deb7u2_s390x.deb |
Debian | 8 | s390x | libfuse-dev | < 2.9.3-15+deb8u1 | libfuse-dev_2.9.3-15+deb8u1_s390x.deb |
Debian | 7 | amd64 | ntfs-3g-dbg | < 1:2012.1.15AR.5-2.1+deb7u2 | ntfs-3g-dbg_1:2012.1.15AR.5-2.1+deb7u2_amd64.deb |
Debian | 7 | s390x | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_s390x.deb |
Debian | 7 | armel | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_armel.deb |
Debian | 7 | mips | libfuse2 | < 2.9.0-2+deb7u2 | libfuse2_2.9.0-2+deb7u2_mips.deb |
Debian | 6 | amd64 | ntfs-3g | < 1:2010.3.6-1+deb6u1 | ntfs-3g_1:2010.3.6-1+deb6u1_amd64.deb |
Debian | 7 | kfreebsd-amd64 | libfuse2-udeb | < 2.9.0-2+deb7u2 | libfuse2-udeb_2.9.0-2+deb7u2_kfreebsd-amd64.deb |
Debian | 6 | i386 | ntfs-3g | < 1:2010.3.6-1+deb6u1 | ntfs-3g_1:2010.3.6-1+deb6u1_i386.deb |
Debian | 7 | i386 | fuse | < 2.9.0-2+deb7u2 | fuse_2.9.0-2+deb7u2_i386.deb |