encfs: Multiple vulnerabilities

encfs: Multiple vulnerabilities Multiple vulnerabilities have been found in encfs, the worst of which can allow remote attackers to execute arbitrary code or cause a Denial of Service condition. encfs December 30, 2015 December 30, 2015: 1 510290 local 1.7.5 1.7.5

Encfs is an implementation of encrypted filesystem in user-space using FUSE.

Multiple vulnerabilities have been discovered in encfs. Please review the CVE identifiers referenced below for details.

A local attacker can utilize a possible buffer overflow in the encodeName method of StreamNameIO and BlockNameIO to execute arbitrary code or cause a Denial of Service. Also multiple weak cryptographics practices have been found in encfs.

There is no known workaround at this time.

All encfs users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=sys-fs/encfs-1.7.5"

CVE-2014-3462 K_F mrueg