Debian 10260 Published by

Updated ntfs-3g packages has been released for Debian 6 LTS



Package : ntfs-3g
Version : 1:2010.3.6-1+deb6u1
CVE ID : CVE-2015-3202

Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for
FUSE, does not scrub the environment before executing mount or umount
with elevated privileges. A local user can take advantage of this flaw
to overwrite arbitrary files and gain elevated privileges by accessing
debugging features via the environment that would not normally be safe
for unprivileged users.