1. CVE-Search
  2. CVE-2012-4024
ID CVE-2012-4024
Summary Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
References
Vulnerable Configurations
  • cpe:2.3:a:squashfs_project:squashfs:1.3:r3:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:1.3:r3:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:2.1:-:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:2.1:-:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:2.1:r2:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:2.1:r2:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:2.2:r2:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:2.2:r2:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.1:-:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.1:-:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.1:r2:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.1:r2:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.2:-:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.2:-:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.2:r2:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.2:r2:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:3.4:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:4.1:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:squashfs_project:squashfs:4.2:*:*:*:*:*:*:*
    cpe:2.3:a:squashfs_project:squashfs:4.2:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 10-01-2020 - 19:07)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bid 54610
confirm https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
gentoo GLSA-201612-40
mandriva MDVSA-2013:128
misc http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
mlist [oss-security] 20120719 CVE-2012-4024 and CVE-2012-4025: Squashfs overflows
osvdb 83898
xf squashfs-getcomponent-bo(77106)
Last major update 10-01-2020 - 19:07
Published 19-07-2012 - 19:55
Last modified 10-01-2020 - 19:07
Back to Top