CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
91.2%
Stack-based buffer overflow in the get_component function in unsquashfs.c
in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to
execute arbitrary code via a crafted list file (aka a crafted file for the
-ef option). NOTE: probably in most cases, the list file is a trusted file
constructed by the program’s user; however, there are some realistic
situations in which a list file would be obtained from an untrusted remote
source.
sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
www.openwall.com/lists/oss-security/2012/07/19/6
launchpad.net/bugs/cve/CVE-2012-4024
nvd.nist.gov/vuln/detail/CVE-2012-4024
security-tracker.debian.org/tracker/CVE-2012-4024
www.cve.org/CVERecord?id=CVE-2012-4024