Red Hat Security AdvisoryRHSA-2024:2396
squashfs-tools security update
Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 9) squashfs-tools-4.4-10.git1.el9
Fixes 2 records
Priority MEDIUM 40
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.02296 · Published 2021-09-14 · Partial fix CWE-22
Priority MEDIUM 40
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.025 · Published 2021-08-27 · Partial fix CWE-22
