rpm package
almalinux/squashfs-tools
pkg:rpm/almalinux/squashfs-tools
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-41072 | — | < 4.4-10.git1.el9 | 4.4-10.git1.el9 | Sep 14, 2021 | squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs | ||
| CVE-2021-40153 | — | < 4.4-10.git1.el9 | 4.4-10.git1.el9 | Aug 27, 2021 | squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing |
- CVE-2021-41072Sep 14, 2021affected < 4.4-10.git1.el9fixed 4.4-10.git1.el9
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs
- CVE-2021-40153Aug 27, 2021affected < 4.4-10.git1.el9fixed 4.4-10.git1.el9
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing