Fuse
Vendor:
First CVE: Jun 3, 2005 · Active for 21 years
7
Total CVEs
More Total CVEs than 49% of tracked products
1.4
Avg CVEs / Year
Bottom 1%
3.8
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Fuse over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 3, 2005
21 years ago
Most Recent CVE
Jul 24, 2018
2,922 days ago
CVE Severity & Scoring
Fuse7 CVEs
86%
14%
All CVEs352,294 CVEs
45%
40%
11%
LowHigh
Attack Vector
Local1 (14.3%)
Network0 (0.0%)
Unknown6 (85.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (14.3%)
High0 (0.0%)
Unknown6 (85.7%)
User Interaction
None1 (14.3%)
Unknown6 (85.7%)
Required0 (0.0%)
Privileges Required
Low1 (14.3%)
High0 (0.0%)
None0 (0.0%)
Unknown6 (85.7%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-10906HIGH In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system | Jul 24, 2018 | 7.8 | 36 | NO | YES |
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via | Jul 2, 2015 | 3.6 | 22 | NO | YES |
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local use | Jun 3, 2005 | 2.1 | 17 | NO | YES |
Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access re | Sep 2, 2011 | 3.3 | 16 | NO | NO |
fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified ve | Sep 2, 2011 | 3.3 | 16 | NO | NO |
fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack. | Sep 2, 2011 | 3.3 | 16 | NO | NO |
fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint. | Mar 2, 2010 | 3.3 | 14 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
3 CVEs
42.9% of CVEs· 93rd percentile
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Fuse
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.8.4 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.8.3 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.8.2 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.8.1 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.8.0 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.7.6 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.7.5 | 3 | 3.3 | 0.3% | 0 | 0 |
| 2.7.4 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.7.3 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.7.2 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.7.1 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.7.0 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.6.5 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.6.3 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.6.1 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.6.0 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.5.3 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.5.2 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.5.1 | 4 | 3.3 | 0.3% | 0 | 0 |
| 2.5.0 | 4 | 3.3 | 0.3% | 0 | 0 |