Package: fuse Version: 2.9.7-1+deb9u1 Severity: normal Attempting to mount a FUSE overlay file system over an autofs or FAT mount fails with the error
fusermount: mounting over filesystem type 0x00000187 is forbidden (for autofs) or fusermount: mounting over filesystem type 0x00004d44 is forbidden (for FAT). This occurs because the autofs and FAT magic numbers are not in debian/patches/CVE-2018-10906/0005-fusermount-whitelist-known-good-filesystems-for-moun.patch. autofs's magic was added to upstream in https://github.com/libfuse/libfuse/commit/0ef031bfc08564e7c5920432e13373dcf18dbc63, but FAT's magic has not been added yet. -- System Information: Debian Release: 9.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.16.0-0.bpo.2-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages fuse depends on: ii adduser 3.115 ii libc6 2.24-11+deb9u3 ii libfuse2 2.9.7-1+deb9u1 ii mount 2.29.2-1+deb9u1 ii sed 4.4-1 fuse recommends no packages. fuse suggests no packages. -- no debconf information
