CVE-2015-3202
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1)...
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
Exploit likelihood
What each source reports
NVD Score used
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
CVE-2015-3202- CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
CVE-2015-3202- Updated
- 2026-11-02
EUVDEUVD-2015-3268 No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
EUVD-2015-3268- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-32rg-hvr8-56hx No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1)...
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
GHSA-32rg-hvr8-56hx- Updated
- 2026-11-02
OSV No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
CVE-2015-3202- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3202 No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
DEBIAN-CVE-2015-3202- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0239 No score
Updated fuse packages fix CVE-2015-3202
Updated fuse packages fix security vulnerability:
Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges (CVE-2015-3202).
- Record
MGASA-2015-0239- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10378-1 No score
fuse-2.9.5-1.6 on GA media
These are all security issues fixed in the fuse-2.9.5-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10378-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1024-1 No score
Security update for FUSE
This update for FUSE fixes the following security issue:
* CVE-2015-3202: FUSE did not clear the environment upon execution of
external programs.
Security Issues:
* CVE-2015-3202
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202>
- Record
SUSE-SU-2015:1024-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1053-1 No score
Security update for fuse
This update fixes a vulnerability in fuse that did not clear the environment upon execution of external programs. CVE-2015-3202 has been assigned to this issue
- Record
SUSE-SU-2015:1053-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3202 No score
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
- Record
UBUNTU-CVE-2015-3202- Updated
- 2026-11-02
OSVUSN-2617-1 No score
fuse vulnerability
Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges.
- Record
USN-2617-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fuseDebian:12 |
before 2.9.3-16 | 2.9.3-16 |
fuseDebian:13 |
before 2.9.3-16 | 2.9.3-16 |
ntfs-3gDebian:12 |
before 1:2014.2.15AR.3-3 | 1:2014.2.15AR.3-3 |
ntfs-3gDebian:13 |
before 1:2014.2.15AR.3-3 | 1:2014.2.15AR.3-3 |
ntfs-3gDebian:14 |
before 1:2014.2.15AR.3-3 | 1:2014.2.15AR.3-3 |
ntfs-3gDebian:6.0 |
before 1:2010.3.6-1+deb6u1, plus listed versions 1:2010.3.6-1 |
1:2010.3.6-1+deb6u1 |
ntfs-3gDebian:6.0 |
before 1:2010.3.6-1+deb6u2, plus listed versions 1:2010.3.6-1 |
1:2010.3.6-1+deb6u2 |
fuseDebian:6.0 |
before 2.8.4-1.1+deb6u1, plus listed versions 2.8.4-1.1 |
2.8.4-1.1+deb6u1 |
fuseDebian:7 |
before 2.9.0-2+deb7u2, plus listed versions 2.9.0-2+deb7u1 |
2.9.0-2+deb7u2 |
fuseDebian:8 |
before 2.9.3-15+deb8u1, plus listed versions 2.9.3-15 |
2.9.3-15+deb8u1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntfs-3gDebian:7 |
before 1:2012.1.15AR.5-2.1+deb7u1, plus listed versions 1:2012.1.15AR.5-2.1 |
1:2012.1.15AR.5-2.1+deb7u1 |
ntfs-3gDebian:8 |
before 1:2014.2.15AR.2-1+deb8u1, plus listed versions 1:2014.2.15AR.2-1 |
1:2014.2.15AR.2-1+deb8u1 |
ntfs-3gDebian:7 |
before 1:2012.1.15AR.5-2.1+deb7u2, plus listed versions 1:2012.1.15AR.5-2.11:2012.1.15AR.5-2.1+deb7u1 |
1:2012.1.15AR.5-2.1+deb7u2 |
ntfs-3gDebian:8 |
before 1:2014.2.15AR.2-1+deb8u2, plus listed versions 1:2014.2.15AR.2-11:2014.2.15AR.2-1+deb8u1 |
1:2014.2.15AR.2-1+deb8u2 |
fuseMageia:4 |
before 2.9.3-2.1.mga4 | 2.9.3-2.1.mga4 |
fuseSUSE:Linux Enterprise Desktop 12 |
before 2.9.3-5.1 | 2.9.3-5.1 |
fuseSUSE:Linux Enterprise Software Development Kit 12 |
before 2.9.3-5.1 | 2.9.3-5.1 |
fuseSUSE:Linux Enterprise Server 12 |
before 2.9.3-5.1 | 2.9.3-5.1 |
fuseSUSE:Linux Enterprise Server for SAP Applications 12 |
before 2.9.3-5.1 | 2.9.3-5.1 |
fuseUbuntu:14.04:LTS |
before 2.9.2-4ubuntu4.14.04.1, plus listed versions 2.9.2-4ubuntu32.9.2-4ubuntu4 |
2.9.2-4ubuntu4.14.04.1 |
fuseopenSUSE:Tumbleweed |
before 2.9.5-1.6 | 2.9.5-1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Fuse 2.9.3-15 - Local Privilege Escalation | 2015-05-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3202 is a low vulnerability (CVSS 3.6) in Fuse Project Fuse, published May 20, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in fuse 2.9.3-16.
References
debian.org/security/2015/dsa-3268
ubuntu.com/usn/USN-2617-1
lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html
securitytracker.com/id/1032386
Show 33 moreShow less
gist.github.com/taviso/ecb70eb12d461dd85cba
securityfocus.com/bid/74765
lists.opensuse.org/opensuse-updates/2015-06/msg00007.html
security.gentoo.org/glsa/201603-04
openwall.com/lists/oss-security/2015/05/21/9
packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html
twitter.com/taviso/status/601370527437967360
exploit-db.com/exploits/37089
nvd.nist.gov/vuln/detail/CVE-2015-3202
github.com/advisories/GHSA-32rg-hvr8-56hx
security-tracker.debian.org/tracker/CVE-2015-3202
advisories.mageia.org/MGASA-2015-0239.html
bugs.mageia.org/show_bug.cgi?id=16016
suse.com/support/update/announcement/2015/suse-su-20151024-1
bugzilla.suse.com/931452
ubuntu.com/security/CVE-2015-3202
cve.org/CVERecord?id=CVE-2015-3202