rpm package
suse/squashfs&distro=SUSE Linux Enterprise Micro 5.1
pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.1
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-41072 | — | < 4.6.1-150300.3.3.1 | 4.6.1-150300.3.3.1 | Sep 14, 2021 | squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs | ||
| CVE-2021-40153 | — | < 4.6.1-150300.3.3.1 | 4.6.1-150300.3.3.1 | Aug 27, 2021 | squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing | ||
| CVE-2015-4646 | Hig | 7.5 | < 4.6.1-150300.3.3.1 | 4.6.1-150300.3.3.1 | Apr 13, 2017 | (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input. | |
| CVE-2015-4645 | Med | 5.5 | < 4.6.1-150300.3.3.1 | 4.6.1-150300.3.3.1 | Mar 17, 2017 | Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow. |
- CVE-2021-41072Sep 14, 2021affected < 4.6.1-150300.3.3.1fixed 4.6.1-150300.3.3.1
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs
- CVE-2021-40153Aug 27, 2021affected < 4.6.1-150300.3.3.1fixed 4.6.1-150300.3.3.1
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing
- affected < 4.6.1-150300.3.3.1fixed 4.6.1-150300.3.3.1
(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.
- affected < 4.6.1-150300.3.3.1fixed 4.6.1-150300.3.3.1
Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.