squashfs-tools: CVE-2021-41072

Debian Bug report logs - #994262
squashfs-tools: CVE-2021-41072

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: squashfs-tools: CVE-2021-41072

Date: Tue, 14 Sep 2021 22:07:40 +0200

Source: squashfs-tools
Version: 1:4.5-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1:4.4-2+deb11u1
Control: found -1 1:4.4-2
Control: found -1 1:4.3-12+deb10u1
Control: found -1 1:4.3-12

Hi,

The following vulnerability was published for squashfs-tools.

CVE-2021-41072[0]:
| squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows
| Directory Traversal, a different vulnerability than CVE-2021-40153. A
| squashfs filesystem that has been crafted to include a symbolic link
| and then contents under the same filename in a filesystem can cause
| unsquashfs to first create the symbolic link pointing outside the
| expected directory, and then the subsequent write operation will cause
| the unsquashfs process to write through the symbolic link elsewhere in
| the filesystem.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-41072
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41072
[1] https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd
[2] https://github.com/plougher/squashfs-tools/commit/19fcc9365dcdb2c22d232d42d11012940df64b7c (Makefile fix)
[3] https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405

Regards,
Salvatore

Send a report that this bug log contains spam.