PT-2012-5152 · Squashfs+1 · Squashfs+1

Sebas Sujeen · Publicado 2012-07-19 · Atualizado 2024-06-15 · CVE-2012-4025

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squashfs versions 4.2 and earlier

Description The issue is related to an integer overflow in the queue init function in unsquashfs.c, which can be exploited by remote attackers via a crafted block log field in the superblock of a .sqsh file. This leads to a heap-based buffer overflow, potentially allowing the execution of arbitrary code.

Recommendations For Squashfs versions 4.2 and earlier, update to a version later than 4.2 to resolve the issue.

Correção

RCE

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2014-1701

CVE-2012-4025

OPENSUSE-SU-2024:10201-1

Produtos afetados

Alt Linux

Squashfs

Referências · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4025 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2013:128 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2014-1701 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201612-40 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-4025 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2012-4025 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4024 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10201-1 · Aviso do Fabricante
• http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4025 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/07/19/6 · Nota
• http://osvdb.org/83899 · Nota
• https://suse.com/security/cve/CVE-2012-4025 · Nota
• http://securityfocus.com/bid/54610 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4025 · Nota de Segurança