{"id":"CVE-2018-10906","aliases":["ALPINE-CVE-2018-10906","AZL-34694","AZL-6430","BELL-CVE-2018-10906","DEBIAN-CVE-2018-10906","DLA-1468-1","DSA-4257-1","EUVD-2018-2962","GHSA-35h9-x59q-8xcf","RHSA-2018:3324","SUSE-SU-2018:3219-1","SUSE-SU-2018:3260-1","SUSE-SU-2019:13948-1","UBUNTU-CVE-2018-10906","USN-5326-1"],"status":"published","title":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction...","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01414,"percentile":0.72919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269","CWE-285"],"published":"2018-07-24T20:00:00Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"exploitdb","id":"EDB-45106","title":"fusermount - user_allow_other Restriction Bypass and SELinux Label Control","type":"dos","platform":"linux","date":"2018-07-30","verified":true,"url":"https://www.exploit-db.com/exploits/45106"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"fuse","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"fuse3","fixed_in":["3.2.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"fuse","fixed_in":["2.9.7-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"fuse","fixed_in":["2.9.7-10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fuse","fixed_in":["2.9.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fuse","fixed_in":["2.9.8-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fuse3","fixed_in":["3.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fuse3","fixed_in":["3.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fuse3","fixed_in":["3.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"fuse","fixed_in":["2.9.3-15+deb8u3"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"fuse","fixed_in":["2.9.7-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-debuginfo","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-libs","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-devel","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-debuginfo","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-libs","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-devel","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-debuginfo","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-devel","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-libs","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-debuginfo","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-devel","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-libs","fixed_in":["0:2.9.2-11.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"fuse","fixed_in":["2.9.3-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"fuse","fixed_in":["2.9.3-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"fuse","fixed_in":["2.9.3-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"fuse","fixed_in":["2.9.3-6.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"fuse","fixed_in":["2.9.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"fuse","fixed_in":["2.8.7-0.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"fuse","fixed_in":["2.8.7-0.11.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"fuse","fixed_in":["2.8.7-0.11.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fuse","fixed_in":["2.9.4-1ubuntu3.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-15+deb8u3"}]}],"versions":["2.9.3-15","2.9.3-15+deb8u1","2.9.3-15+deb8u2"]},{"source":"osv","ecosystem":"Debian:9","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1+deb9u1"}]}],"versions":["2.9.7-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"fuse-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"fuse-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"fuse-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"fuse-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.2-11.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-6.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7-0.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7-0.11.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7-0.11.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.2-4ubuntu3","2.9.2-4ubuntu4","2.9.2-4ubuntu4.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1ubuntu3.1+esm1"}]}],"versions":["2.9.4-1ubuntu1","2.9.4-1ubuntu2","2.9.4-1ubuntu3","2.9.4-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.7-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1ubuntu3.1+esm1"}]}],"versions":["2.9.4-1ubuntu1","2.9.4-1ubuntu2","2.9.4-1ubuntu3","2.9.4-1ubuntu3.1"]}],"products":[{"vendor":"[unknown]","product":"fuse"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fuse_project","product":"fuse"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10906","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/08/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4257","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/45106/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3324","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BREAIWIK64DRJWHIGR47L2D5YICY4HQ3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5XYA6PXT5PPWVK7CM7K4YRCYWA37DODB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A253TZWZK6R7PT2S5JIEAQJR2TYKX7V2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10906","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XYA6PXT5PPWVK7CM7K4YRCYWA37DODB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A253TZWZK6R7PT2S5JIEAQJR2TYKX7V2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BREAIWIK64DRJWHIGR47L2D5YICY4HQ3/"},{"url":"https://github.com/advisories/GHSA-35h9-x59q-8xcf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-10906","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-10906","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10906","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1602996","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3324.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10906","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10906","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183219-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1101797","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10906","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183260-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913948-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10906","tags":["report"]},{"url":"https://github.com/libfuse/libfuse/pull/268","tags":["report"]},{"url":"https://sourceforge.net/p/fuse/mailman/message/36374753/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5326-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:00:00Z","modified":"2024-08-05T07:54:35.543Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2962","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:00:00Z","modified":"2024-08-05T07:54:35Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T02:39:57.544825Z"}],"ghsa":[{"id":"GHSA-35h9-x59q-8xcf","title":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction...","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2022-05-13T01:48:57Z","modified":"2023-02-02T05:01:40Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:51:13.974749Z"}],"nvd":[{"id":"CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00.347Z","modified":"2026-06-17T01:34:53.45Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-269"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"ALPINE-CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00.347Z","modified":"2026-10-23T17:17:55.200859103Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"AZL-34694","title":"CVE-2018-10906 affecting package fuse for versions less than 2.9.7-10","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"AZL-6430","title":"CVE-2018-10906 affecting package fuse for versions less than 2.9.7-10","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00Z","modified":"2026-04-21T04:32:21.366518Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2018-10906","title":"CVE-2018-10906 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:39.38304Z","modified":"2026-01-26T09:48:28.477747Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00.347Z","modified":"2026-10-24T10:30:44.209958086Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00.347Z","modified":"2026-10-23T18:03:35.901125642Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:3324","title":"Red Hat Security Advisory: fuse security update","status":"published","published":"2024-09-16T01:41:28Z","modified":"2026-07-01T10:04:59Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-10906","description":"In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.","status":"published","published":"2018-07-24T20:29:00Z","modified":"2026-04-22T11:41:03.802929Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1468-1","title":"fuse - security update","status":"published","published":"2018-08-15T00:00:00Z","modified":"2026-03-09T01:01:18.822408Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4257-1","title":"fuse - security update","status":"published","published":"2018-07-28T00:00:00Z","modified":"2026-03-09T02:10:01.226979Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"SUSE-SU-2018:3219-1","title":"Security update for fuse","description":"This update for fuse fixes the following security issue:\n\n- CVE-2018-10906: fusermount was vulnerable to a restriction bypass when\n  SELinux is active. This allowed non-root users to mount a FUSE file system with\n  the 'allow_other' mount option regardless of whether 'user_allow_other' is set\n  in the fuse configuration. An attacker may use this flaw to mount a FUSE file\n  system, accessible by other users, and trick them into accessing files on that\n  file system, possibly causing Denial of Service or other unspecified effects\n  (bsc#1101797)\n","status":"published","published":"2018-10-18T09:58:08Z","modified":"2026-02-04T02:31:53.554988Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3260-1","title":"Security update for fuse","description":"This update for fuse fixes the following issues:\n\n- CVE-2018-10906: fusermount was vulnerable to a restriction bypass when\n  SELinux is active. This allowed non-root users to mount a FUSE file system with\n  the 'allow_other' mount option regardless of whether 'user_allow_other' is set\n  in the fuse configuration. An attacker may use this flaw to mount a FUSE file\n  system, accessible by other users, and trick them into accessing files on that\n  file system, possibly causing Denial of Service or other unspecified effects\n  (bsc#1101797)\n","status":"published","published":"2018-10-19T14:05:56Z","modified":"2026-02-04T04:17:10.702467Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:13948-1","title":"Security update for fuse","description":"This update for fuse fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-10906: Fix a bypass of the user_allow_other restriction (bsc#1101797)\n","status":"published","published":"2019-02-08T13:47:53Z","modified":"2026-02-04T04:18:49.272267Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-5326-1","title":"fuse vulnerability","description":"It was discovered that FUSE is susceptible to a restriction bypass flaw\non a system that has SELinux active. A local attacker with non-root\nprivileges could mount a FUSE file system that is accessible to other\nusers and trick them into accessing files on that file system, which \ncould result in a Denial of Service or other unspecified conditions.\n","status":"published","published":"2022-03-16T22:20:55Z","modified":"2026-06-25T13:31:03.56313263Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}