Re: Accepted fuse 2.8.4-1.1+deb6u1 (source amd64) into squeeze-lts

[László Böszörményi (GCS) <gcs@debian.org>]

Hi all,

On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel
<mike.gabriel@das-netzwerkteam.de> wrote:
> On  Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote:
>> On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote:
>>> Source: fuse
>>> Version: 2.8.4-1.1+deb6u1
>>
>> there was no DLA for this upload, could you please prepare one and send it
>> to
>> the list?! Thanks already.
 You mean to debian-lts-announce, right?

> Let me know if you need a hand with this.
 Please review the following, I'm open for suggestions.
-- cut --
Subject: [DLA 238-1] fuse security update

Package        : fuse
Version        : 2.8.4-1.1+deb6u1
CVE ID         : CVE-2015-3202
Debian Bug     : #786439

Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not
scrub the environment before executing mount or umount with elevated
privileges. A local user can take advantage of this flaw to overwrite
arbitrary files and gain elevated privileges by accessing debugging
features via the environment that would not normally be safe for
unprivileged users.

For the old-oldstable distribution (squeeze-lts), this problem has been fixed
in version 2.8.4-1.1+deb6u1.

We recommend that you upgrade your fuse packages.
-- cut --

Thanks,
Laszlo/GCS