ELSA-2024-3139 — Moderate: squashfs-tools security update (Oracle Linux 8)

Summary

[4.3-21]
- CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
Resolves: rhbz#2007303 rhbz#2000637

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	squashfs-tools	0:4.3-21.el8

Vulnerabilities 2

Unscored —

CVE-2021-40153

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by…

squashfs-tools squashfs-tools squashfs-tools squashfs-tools Debian Ubuntu Azure Linux Alpine

Aug 27, 2021
Unscored —

CVE-2021-41072

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2…

squashfs-tools squashfs-tools squashfs-tools squashfs-tools Debian Ubuntu Azure Linux Alpine

Sep 14, 2021

Moderate: squashfs-tools security update (Oracle Linux 8)

Summary

Fixed packages 1

Vulnerabilities 2

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by…

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2…