Description
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squashfs-tools | 1:4.2+20121212-1 | — |
| Debian 13 | squashfs-tools | 1:4.2+20121212-1 | — |
| Debian 12 | squashfs-tools | 1:4.2+20121212-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | squashfs | 4.3-9.3 | openSUSE-SU-2024:10201-1 |
Advisories 1
- openSUSE-SU-2024:10201-1 squashfs-4.3-9.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120719 CVE-2012-4024 and CVE-2012-4025: Squashfs overflows mailing-list
- 83899 vdb-entry
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
- http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
- 54610 vdb-entry
- GLSA-201612-40 vendor-advisory
- MDVSA-2013:128 vendor-advisory