Red Hat Security AdvisoryRHSA-2024:3139
squashfs-tools security update
Released 2024-05-22 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) squashfs-tools-4.3-21.el8
Fixes 2 records
Priority MEDIUM 40
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.02296 · Published 2021-09-14 · Partial fix CWE-22
Priority MEDIUM 40
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.025 · Published 2021-08-27 · Partial fix CWE-22
