fuse-2.9.2-11.el7

The fuse packages contain the File System in Userspace (FUSE) tools to mount a FUSE file system. With FUSE, it is possible to implement a fully functional file system in a user-space program.

Security Fix(es):

* fuse: bypass of the "user_allow_other" restriction when SELinux is active (CVE-2018-10906)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Asianux Server 7.6 Release Notes linked from the References section.

CVE-2018-10906
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is
vulnerable to a restriction bypass when SELinux is active. This allows
non-root users to mount a FUSE file system with the 'allow_other'
mount option regardless of whether 'user_allow_other' is set in the
fuse configuration. An attacker may use this flaw to mount a FUSE file
system, accessible by other users, and trick them into accessing files
on that file system, possibly causing Denial of Service or other
unspecified effects.