All errata/sisyphus/ALT-PU-2014-1701-1
ALT-PU-2014-1701-1

Package update squashfs-tools in branch sisyphus

Version4.3-alt1
Task#120527
Published2014-06-02
Max severityMEDIUM
Severity:

Closed issues (2)

CVE-2012-4024
MEDIUM6.8

Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.

Published: 2012-07-19Modified: 2026-04-29
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References
CVE-2012-4025
MEDIUM6.8

Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.

Published: 2012-07-19Modified: 2026-04-29
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References