CVE-2015-8836: Buffer Overflow
An integer overflow, leading to heap-based buffer overflow flaw was found in the way FuseISO, a FUSE module to mount ISO filesystem images, performed reading of certain ZF blocks of particular inode. A remote attacker could provide a specially-crafted ISO file that, when mounted via fuseiso tool would lead to fuseiso binary crash.
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security Team.
Other sources
Integer overflow in the isofsrealreadzf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8836?
CVE-2015-8836 has been classified as a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2015-8836?
To fix CVE-2015-8836, update FuseISO to a version later than 20070708 or upgrade to a newer version of the Fedora operating system.
What types of systems are affected by CVE-2015-8836?
CVE-2015-8836 affects Fedora versions 16 and 17, as well as specific versions of the FuseISO application.
Can CVE-2015-8836 be exploited remotely?
Yes, CVE-2015-8836 can be exploited remotely by an attacker providing a specially-crafted ISO file.
What impact does CVE-2015-8836 have on affected systems?
CVE-2015-8836 can lead to a heap-based buffer overflow, potentially allowing an attacker to execute arbitrary code on the affected system.