CVE-2005-1858
published 2005-06-03CVE-2005-1858: FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request…
PriorityP49low2.1CVSS 2.0
AVLACLAuNCPINAN
EXPLOIT
EPSS
0.76%
51.2th percentile
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | fuse | < fuse 2.3.0-1 (bookworm) | fuse 2.3.0-1 (bookworm) |
| fuse | fuse | — | — |
| fuse | fuse | — | — |
| fuse | fuse | — | — |
| fuse | fuse | — | — |
| redhat | fuse | >= 0 < 2.3.0-1 | 2.3.0-1 |
| redhat | fuse | >= 0 < 2.3.0-1 | 2.3.0-1 |
| redhat | fuse | >= 0 < 2.3.0-1 | 2.3.0-1 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv2.1LOW
vendor_debian2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4x4q-c47m-2xv4: FUSE 2
ghsa_unreviewed·2022-05-01
CVE-2005-1858 [LOW] GHSA-4x4q-c47m-2xv4: FUSE 2
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
OSV
CVE-2005-1858: FUSE 2
osv·2005-06-03·CVSS 2.1
CVE-2005-1858 [LOW] CVE-2005-1858: FUSE 2
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
Debian
CVE-2005-1858: fuse - FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfill...
vendor_debian·2005·CVSS 2.1
CVE-2005-1858 [LOW] CVE-2005-1858: fuse - FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfill...
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
Scope: local
bookworm: resolved (fixed in 2.3.0-1)
bullseye: resolved (fixed in 2.3.0-1)
sid: resolved (fixed in 2.3.0-1)
trixie: resolved (fixed in 2.3.0-1)
No detection rules found.
Bugzilla
CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835 CVE-2005-3510 CVE-2005-4838)
bugzilla·2007-04-30·CVSS 4.3
CVE-2005-2090 [MEDIUM] CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835 CVE-2005-3510 CVE-2005-4838)
CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835 CVE-2005-3510 CVE-2005-4838)
A number of flaws affect the version of Tomcat5 shipped with RHAPS-EL3 (last
updated in RHSA-2006:0592 to 5.0.28). Please see linked bugs for details.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2007-0340.html
Bugzilla
CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835)
bugzilla·2007-04-19·CVSS 4.3
CVE-2005-2090 [MEDIUM] CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835)
CVE-2005-2090 multiple tomcat issues (CVE-2007-0450 CVE-2006-7195 CVE-2006-7196 CVE-2007-1858 CVE-2006-3835)
A number of flaws affect the version of Tomcat5 shipped with RHAPS2 (last
updated in RHSA-2006:0161 to 5.5.12). Please see linked bugs for details.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2007-0326.html
CWE
Unexpected Status Code or Return Value
mitre_cwe·CVSS 7.5
[HIGH] CWE-394 Unexpected Status Code or Return Value
CWE-394: Unexpected Status Code or Return Value
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Other. Impact: Unexpected State, Alter Execution Logic.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinati
CWE
Sensitive Information in Resource Not Removed Before Reuse
mitre_cwe
CWE-226 Sensitive Information in Resource Not Removed Before Reuse
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
When resources are released, they can be made available for reuse. For example, after memory is de-allocated, an operating system may make the memory available to another process, or disk space may be reallocated when a file is deleted. As removing information requires time and additional resources, operating systems do not usually clear the previously written information. Even when the resource is reused by the same process, this
http://bugs.debian.org/311634http://secunia.com/advisories/15561/http://secunia.com/advisories/16024http://securitytracker.com/id?1014107http://sourceforge.net/project/shownotes.php?release_id=331884http://www.debian.org/security/2005/dsa-744http://www.osvdb.org/17042http://www.securityfocus.com/bid/13857http://www.sven-tantau.de/public_files/fuse/fuse_20050603.txthttp://bugs.debian.org/311634http://secunia.com/advisories/15561/http://secunia.com/advisories/16024http://securitytracker.com/id?1014107http://sourceforge.net/project/shownotes.php?release_id=331884http://www.debian.org/security/2005/dsa-744http://www.osvdb.org/17042http://www.securityfocus.com/bid/13857http://www.sven-tantau.de/public_files/fuse/fuse_20050603.txt
2005-06-03
Published