CVE-2012-4024
- State
- Published
- Severity
- Not scored
- Published
- Jul 19, 2012
- Updated
- Aug 6, 2024
- Reserved
- Jul 16, 2012
Description
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20120719 CVE-2012-4024 and CVE-2012-4025: Squashfs overflowsmailing-list
- 83898vdb-entry
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
- http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
- 54610vdb-entry
- GLSA-201612-40vendor-advisory
- MDVSA-2013:128vendor-advisory
- squashfs-getcomponent-bo(77106)vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.