{"id":"CVE-2015-3202","aliases":["DEBIAN-CVE-2015-3202","DLA-226-1","DLA-226-2","DLA-238-1","DSA-3266-1","DSA-3268-1","DSA-3268-2","EUVD-2015-3268","GHSA-32rg-hvr8-56hx","MGASA-2015-0239","SUSE-SU-2015:1024-1","SUSE-SU-2015:1053-1","UBUNTU-CVE-2015-3202","USN-2617-1","openSUSE-SU-2024:10378-1"],"status":"published","title":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1)...","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","severity":{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01004,"percentile":0.63184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264"],"published":"2015-05-20T13:07:40Z","modified":"2026-09-09T06:47:22Z","exploits":[{"source":"exploitdb","id":"EDB-37089","title":"Fuse 2.9.3-15 - Local Privilege Escalation","type":"local","platform":"linux","date":"2015-05-23","verified":true,"url":"https://www.exploit-db.com/exploits/37089"}],"fixes":[{"ecosystem":"Debian:12","package":"fuse","fixed_in":["2.9.3-16"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fuse","fixed_in":["2.9.3-16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ntfs-3g","fixed_in":["1:2014.2.15AR.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ntfs-3g","fixed_in":["1:2014.2.15AR.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ntfs-3g","fixed_in":["1:2014.2.15AR.3-3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"ntfs-3g","fixed_in":["1:2010.3.6-1+deb6u1","1:2010.3.6-1+deb6u2"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"fuse","fixed_in":["2.8.4-1.1+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"fuse","fixed_in":["2.9.0-2+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"fuse","fixed_in":["2.9.3-15+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ntfs-3g","fixed_in":["1:2012.1.15AR.5-2.1+deb7u1","1:2012.1.15AR.5-2.1+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ntfs-3g","fixed_in":["1:2014.2.15AR.2-1+deb8u1","1:2014.2.15AR.2-1+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"fuse","fixed_in":["2.9.3-2.1.mga4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"fuse","fixed_in":["2.9.3-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"fuse","fixed_in":["2.9.3-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"fuse","fixed_in":["2.9.3-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"fuse","fixed_in":["2.9.3-5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"fuse","fixed_in":["2.9.2-4ubuntu4.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-16"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.3-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2010.3.6-1+deb6u1"}]}],"versions":["1:2010.3.6-1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2010.3.6-1+deb6u2"}]}],"versions":["1:2010.3.6-1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1.1+deb6u1"}]}],"versions":["2.8.4-1.1"]},{"source":"osv","ecosystem":"Debian:7","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-2+deb7u2"}]}],"versions":["2.9.0-2+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-15+deb8u1"}]}],"versions":["2.9.3-15"]},{"source":"osv","ecosystem":"Debian:7","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2012.1.15AR.5-2.1+deb7u1"}]}],"versions":["1:2012.1.15AR.5-2.1"]},{"source":"osv","ecosystem":"Debian:8","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.2-1+deb8u1"}]}],"versions":["1:2014.2.15AR.2-1"]},{"source":"osv","ecosystem":"Debian:7","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2012.1.15AR.5-2.1+deb7u2"}]}],"versions":["1:2012.1.15AR.5-2.1","1:2012.1.15AR.5-2.1+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.2-1+deb8u2"}]}],"versions":["1:2014.2.15AR.2-1","1:2014.2.15AR.2-1+deb8u1"]},{"source":"osv","ecosystem":"Mageia:4","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2.1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-4ubuntu4.14.04.1"}]}],"versions":["2.9.2-4ubuntu3","2.9.2-4ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-4ubuntu4.14.04.1"}]}],"versions":["2.9.2-4ubuntu3","2.9.2-4ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.5-1.6"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fuse_project","product":"fuse"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3268","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2617-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032386","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://gist.github.com/taviso/ecb70eb12d461dd85cba","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://www.securityfocus.com/bid/74765","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3266","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201603-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2617-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/21/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://twitter.com/taviso/status/601370527437967360","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/37089/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2617-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3202"},{"url":"https://www.exploit-db.com/exploits/37089"},{"url":"https://github.com/advisories/GHSA-32rg-hvr8-56hx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3202","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16016","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2617-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151024-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/931452","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3202","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151053-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3202","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2617-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2617-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2617-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3202","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0541","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3202","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-07-02T21:16:00Z","modified":"2024-08-06T05:39:31.9Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3268","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-07-02T21:16:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-32rg-hvr8-56hx","title":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1)...","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2022-05-17T02:38:48Z","modified":"2025-04-12T12:50:23Z","updated_at":"2026-11-02T15:01:22.814855Z"}],"nvd":[{"id":"CVE-2015-3202","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-07-02T21:59:03.143Z","modified":"2026-06-17T00:25:31.813Z","cvss":[{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CVE-2015-3202","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-07-02T21:59:03Z","modified":"2026-04-16T06:19:38.543695625Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3202","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-07-02T21:59:03.143Z","modified":"2026-09-09T06:47:22.695708697Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-226-1","title":"ntfs-3g - security update","status":"published","published":"2015-05-25T00:00:00Z","modified":"2026-03-09T01:23:34.345538Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-226-2","title":"ntfs-3g - regression update","status":"published","published":"2015-05-26T00:00:00Z","modified":"2026-03-09T01:19:44.869768Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-238-1","title":"fuse - security update","status":"published","published":"2015-06-07T00:00:00Z","modified":"2026-03-09T01:22:24.188893Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3266-1","title":"fuse - security update","status":"published","published":"2015-05-21T00:00:00Z","modified":"2026-03-09T01:22:40.072408Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3268-1","title":"ntfs-3g - security update","status":"published","published":"2015-05-22T00:00:00Z","modified":"2026-03-09T01:18:18.343438Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3268-2","title":"ntfs-3g - security update","status":"published","published":"2015-05-26T00:00:00Z","modified":"2026-03-09T01:18:58.13998Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0239","title":"Updated fuse packages fix CVE-2015-3202","description":"Updated fuse packages fix security vulnerability:\n\nTavis Ormandy discovered that FUSE incorrectly filtered environment variables.\nA local attacker could use this issue to gain administrative privileges\n(CVE-2015-3202).\n","status":"published","published":"2015-05-27T16:57:52Z","modified":"2026-04-16T06:23:11.02041757Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10378-1","title":"fuse-2.9.5-1.6 on GA media","description":"These are all security issues fixed in the fuse-2.9.5-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:17.369348Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:1024-1","title":"Security update for FUSE","description":"\nThis update for FUSE fixes the following security issue:\n\n    * CVE-2015-3202: FUSE did not clear the environment upon execution of\n      external programs.\n\nSecurity Issues:\n\n    * CVE-2015-3202\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202\u003e\n\n","status":"published","published":"2015-05-20T15:51:53Z","modified":"2026-02-04T04:27:55.042883Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1053-1","title":"Security update for fuse","description":"\nThis update fixes a vulnerability in fuse that \ndid not clear the environment upon execution of external programs. \nCVE-2015-3202 has been assigned to this issue\n","status":"published","published":"2015-05-20T13:07:40Z","modified":"2026-02-04T03:31:22.898626Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3202","description":"fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.","status":"published","published":"2015-05-21T00:00:00Z","modified":"2026-04-22T10:07:27.041433Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2617-1","title":"fuse vulnerability","description":"Tavis Ormandy discovered that FUSE incorrectly filtered environment\nvariables. A local attacker could use this issue to gain administrative\nprivileges.\n","status":"published","published":"2015-05-21T16:02:59Z","modified":"2026-04-22T09:13:18.976965Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}