Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-40153 (GCVE-0-2021-40153)
Vulnerability from cvelistv5 – Published: 2021-08-27 00:00 – Updated: 2024-08-04 02:27
VLAI?
EPSS
Summary
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:27:31.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"name": "FEDORA-2021-cdbd827c1e",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2752-1] squashfs-tools security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"name": "DSA-4967",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4967"
},
{
"name": "FEDORA-2021-9fb6da134f",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"name": "GLSA-202305-29",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202305-29"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-30T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"name": "FEDORA-2021-cdbd827c1e",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2752-1] squashfs-tools security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"name": "DSA-4967",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4967"
},
{
"name": "FEDORA-2021-9fb6da134f",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"name": "GLSA-202305-29",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202305-29"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-40153",
"datePublished": "2021-08-27T00:00:00",
"dateReserved": "2021-08-27T00:00:00",
"dateUpdated": "2024-08-04T02:27:31.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:squashfs-tools_project:squashfs-tools:4.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"259A52A7-B40A-45B5-B5F5-CE79A4DE4266\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A930E247-0B43-43CB-98FF-6CE7B8189835\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4CFF558-3C47-480D-A2F0-BABF26042943\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.\"}, {\"lang\": \"es\", \"value\": \"La funci\\u00f3n squashfs_opendir en el archivo unsquash-1.c en Squashfs-Tools versi\\u00f3n 4.5, almacena el nombre del archivo en la entrada del directorio; esto es entonces usado por unsquashfs para crear el nuevo archivo durante el desensamblaje. El nombre de archivo no se comprueba para saltar fuera del directorio de destino, y por lo tanto permite escribir en lugares fuera del destino.\"}]",
"id": "CVE-2021-40153",
"lastModified": "2024-11-21T06:23:40.510",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:P\", \"baseScore\": 5.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2021-08-27T15:15:09.657",
"references": "[{\"url\": \"https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/plougher/squashfs-tools/issues/72\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/202305-29\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.debian.org/security/2021/dsa-4967\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/plougher/squashfs-tools/issues/72\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202305-29\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2021/dsa-4967\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-40153\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2021-08-27T15:15:09.657\",\"lastModified\":\"2024-11-21T06:23:40.510\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n squashfs_opendir en el archivo unsquash-1.c en Squashfs-Tools versi\u00f3n 4.5, almacena el nombre del archivo en la entrada del directorio; esto es entonces usado por unsquashfs para crear el nuevo archivo durante el desensamblaje. El nombre de archivo no se comprueba para saltar fuera del directorio de destino, y por lo tanto permite escribir en lugares fuera del destino.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:P\",\"baseScore\":5.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:squashfs-tools_project:squashfs-tools:4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"259A52A7-B40A-45B5-B5F5-CE79A4DE4266\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A930E247-0B43-43CB-98FF-6CE7B8189835\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}],\"references\":[{\"url\":\"https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/plougher/squashfs-tools/issues/72\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202305-29\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2021/dsa-4967\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/plougher/squashfs-tools/issues/72\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202305-29\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2021/dsa-4967\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
CERTFR-2024-AVI-0741
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Juniper Secure Analytics. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | Secure Analytics | Juniper Secure Analytics versions antérieures à 7.5.0 UP9 IF02 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Juniper Secure Analytics versions ant\u00e9rieures \u00e0 7.5.0 UP9 IF02",
"product": {
"name": "Secure Analytics",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-29483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29483"
},
{
"name": "CVE-2024-42472",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42472"
},
{
"name": "CVE-2024-26934",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26934"
},
{
"name": "CVE-2023-52477",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52477"
},
{
"name": "CVE-2023-52675",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52675"
},
{
"name": "CVE-2023-4692",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4692"
},
{
"name": "CVE-2024-27059",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27059"
},
{
"name": "CVE-2024-26656",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26656"
},
{
"name": "CVE-2024-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28834"
},
{
"name": "CVE-2023-38264",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38264"
},
{
"name": "CVE-2024-26974",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26974"
},
{
"name": "CVE-2024-26897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26897"
},
{
"name": "CVE-2021-47055",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47055"
},
{
"name": "CVE-2020-36777",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36777"
},
{
"name": "CVE-2023-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43788"
},
{
"name": "CVE-2024-27052",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27052"
},
{
"name": "CVE-2023-52425",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
},
{
"name": "CVE-2024-26585",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26585"
},
{
"name": "CVE-2024-25744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25744"
},
{
"name": "CVE-2024-26973",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26973"
},
{
"name": "CVE-2024-33602",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33602"
},
{
"name": "CVE-2024-27397",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27397"
},
{
"name": "CVE-2024-35854",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35854"
},
{
"name": "CVE-2023-52878",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52878"
},
{
"name": "CVE-2021-47185",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47185"
},
{
"name": "CVE-2024-23650",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23650"
},
{
"name": "CVE-2024-26603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26603"
},
{
"name": "CVE-2024-26964",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26964"
},
{
"name": "CVE-2024-5564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5564"
},
{
"name": "CVE-2021-33198",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33198"
},
{
"name": "CVE-2024-26993",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26993"
},
{
"name": "CVE-2019-25162",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25162"
},
{
"name": "CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"name": "CVE-2023-39321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39321"
},
{
"name": "CVE-2024-3933",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3933"
},
{
"name": "CVE-2024-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1975"
},
{
"name": "CVE-2023-52669",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52669"
},
{
"name": "CVE-2019-11358",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
},
{
"name": "CVE-2020-15778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15778"
},
{
"name": "CVE-2022-3287",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3287"
},
{
"name": "CVE-2024-36004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36004"
},
{
"name": "CVE-2024-26859",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26859"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-29857",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29857"
},
{
"name": "CVE-2024-35959",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35959"
},
{
"name": "CVE-2018-20060",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20060"
},
{
"name": "CVE-2024-35855",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35855"
},
{
"name": "CVE-2024-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1737"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2024-33600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33600"
},
{
"name": "CVE-2024-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3652"
},
{
"name": "CVE-2024-26615",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26615"
},
{
"name": "CVE-2023-45802",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45802"
},
{
"name": "CVE-2024-26801",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26801"
},
{
"name": "CVE-2024-36007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36007"
},
{
"name": "CVE-2021-47311",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47311"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2024-26643",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26643"
},
{
"name": "CVE-2024-26779",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26779"
},
{
"name": "CVE-2024-32021",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32021"
},
{
"name": "CVE-2024-33599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33599"
},
{
"name": "CVE-2024-25629",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25629"
},
{
"name": "CVE-2024-28180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28180"
},
{
"name": "CVE-2024-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24806"
},
{
"name": "CVE-2024-35852",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35852"
},
{
"name": "CVE-2024-23307",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23307"
},
{
"name": "CVE-2024-30172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
},
{
"name": "CVE-2023-52528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52528"
},
{
"name": "CVE-2024-27048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27048"
},
{
"name": "CVE-2021-47013",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47013"
},
{
"name": "CVE-2023-52781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52781"
},
{
"name": "CVE-2024-35845",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35845"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2023-48795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
},
{
"name": "CVE-2021-47073",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47073"
},
{
"name": "CVE-2024-26804",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26804"
},
{
"name": "CVE-2024-26593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26593"
},
{
"name": "CVE-2022-48627",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48627"
},
{
"name": "CVE-2021-47171",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47171"
},
{
"name": "CVE-2024-26743",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26743"
},
{
"name": "CVE-2023-52686",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52686"
},
{
"name": "CVE-2021-47236",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47236"
},
{
"name": "CVE-2023-39318",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39318"
},
{
"name": "CVE-2023-6240",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6240"
},
{
"name": "CVE-2024-32004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32004"
},
{
"name": "CVE-2021-47118",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47118"
},
{
"name": "CVE-2024-35890",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35890"
},
{
"name": "CVE-2020-23064",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
},
{
"name": "CVE-2023-6918",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6918"
},
{
"name": "CVE-2024-22195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22195"
},
{
"name": "CVE-2023-52877",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52877"
},
{
"name": "CVE-2024-21011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
},
{
"name": "CVE-2024-32020",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32020"
},
{
"name": "CVE-2024-0450",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0450"
},
{
"name": "CVE-2023-45803",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"name": "CVE-2023-39319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39319"
},
{
"name": "CVE-2024-32487",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32487"
},
{
"name": "CVE-2024-26826",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26826"
},
{
"name": "CVE-2024-27056",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27056"
},
{
"name": "CVE-2024-26583",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26583"
},
{
"name": "CVE-2024-26642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26642"
},
{
"name": "CVE-2021-47153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47153"
},
{
"name": "CVE-2024-35888",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35888"
},
{
"name": "CVE-2023-52700",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52700"
},
{
"name": "CVE-2023-31122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31122"
},
{
"name": "CVE-2023-52439",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52439"
},
{
"name": "CVE-2021-47495",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47495"
},
{
"name": "CVE-2024-26675",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26675"
},
{
"name": "CVE-2019-14865",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14865"
},
{
"name": "CVE-2024-26906",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26906"
},
{
"name": "CVE-2024-26610",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26610"
},
{
"name": "CVE-2024-2357",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2357"
},
{
"name": "CVE-2024-26584",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26584"
},
{
"name": "CVE-2024-21094",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
},
{
"name": "CVE-2024-26919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26919"
},
{
"name": "CVE-2023-52445",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52445"
},
{
"name": "CVE-2024-33601",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33601"
},
{
"name": "CVE-2024-3019",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3019"
},
{
"name": "CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"name": "CVE-2024-27014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27014"
},
{
"name": "CVE-2021-34558",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34558"
},
{
"name": "CVE-2024-32465",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32465"
},
{
"name": "CVE-2024-22365",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22365"
},
{
"name": "CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"name": "CVE-2023-43789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43789"
},
{
"name": "CVE-2024-38428",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38428"
},
{
"name": "CVE-2024-25062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25062"
},
{
"name": "CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2024-26892",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26892"
},
{
"name": "CVE-2024-35835",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35835"
},
{
"name": "CVE-2024-26735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26735"
},
{
"name": "CVE-2023-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52881"
},
{
"name": "CVE-2023-4693",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4693"
},
{
"name": "CVE-2021-46972",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46972"
},
{
"name": "CVE-2023-52578",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52578"
},
{
"name": "CVE-2024-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26461"
},
{
"name": "CVE-2024-34750",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34750"
},
{
"name": "CVE-2024-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26458"
},
{
"name": "CVE-2021-46934",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46934"
},
{
"name": "CVE-2024-1048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1048"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2023-52598",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52598"
},
{
"name": "CVE-2020-11022",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
},
{
"name": "CVE-2023-7008",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7008"
},
{
"name": "CVE-2024-26659",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26659"
},
{
"name": "CVE-2023-52667",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52667"
},
{
"name": "CVE-2024-26933",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26933"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2023-52703",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52703"
},
{
"name": "CVE-2023-52594",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52594"
},
{
"name": "CVE-2024-26693",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26693"
},
{
"name": "CVE-2023-52595",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52595"
},
{
"name": "CVE-2024-30171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30171"
},
{
"name": "CVE-2023-45287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
},
{
"name": "CVE-2022-48624",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48624"
},
{
"name": "CVE-2024-26759",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26759"
},
{
"name": "CVE-2023-52464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52464"
},
{
"name": "CVE-2023-52813",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52813"
},
{
"name": "CVE-2024-35838",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35838"
},
{
"name": "CVE-2023-52513",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52513"
},
{
"name": "CVE-2023-52615",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52615"
},
{
"name": "CVE-2023-52610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52610"
},
{
"name": "CVE-2023-52560",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52560"
},
{
"name": "CVE-2024-3651",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3651"
},
{
"name": "CVE-2023-39322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39322"
},
{
"name": "CVE-2023-52606",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52606"
},
{
"name": "CVE-2021-47069",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47069"
},
{
"name": "CVE-2024-35960",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35960"
},
{
"name": "CVE-2022-39253",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39253"
},
{
"name": "CVE-2024-34064",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34064"
},
{
"name": "CVE-2023-2953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2953"
},
{
"name": "CVE-2024-26872",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26872"
},
{
"name": "CVE-2020-26555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
},
{
"name": "CVE-2024-26901",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26901"
},
{
"name": "CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"name": "CVE-2024-21085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
},
{
"name": "CVE-2023-29409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29409"
},
{
"name": "CVE-2024-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35789"
},
{
"name": "CVE-2023-52835",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52835"
},
{
"name": "CVE-2024-26982",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26982"
},
{
"name": "CVE-2021-47310",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47310"
},
{
"name": "CVE-2023-52626",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52626"
},
{
"name": "CVE-2024-0340",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0340"
},
{
"name": "CVE-2024-26744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26744"
},
{
"name": "CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"name": "CVE-2024-35958",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35958"
},
{
"name": "CVE-2021-47456",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47456"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2024-32002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32002"
},
{
"name": "CVE-2022-48669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48669"
},
{
"name": "CVE-2023-52565",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52565"
},
{
"name": "CVE-2023-52520",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52520"
},
{
"name": "CVE-2021-47356",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47356"
},
{
"name": "CVE-2024-26694",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26694"
},
{
"name": "CVE-2024-2961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2961"
},
{
"name": "CVE-2024-26664",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26664"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2021-47353",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47353"
},
{
"name": "CVE-2023-6597",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6597"
},
{
"name": "CVE-2023-52607",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52607"
},
{
"name": "CVE-2024-6345",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"name": "CVE-2018-25091",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25091"
},
{
"name": "CVE-2023-5090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5090"
},
{
"name": "CVE-2024-27410",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27410"
},
{
"name": "CVE-2021-46909",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46909"
},
{
"name": "CVE-2024-35853",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35853"
},
{
"name": "CVE-2024-26907",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26907"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0741",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-05T00:00:00.000000"
},
{
"description": "Ajout r\u00e9f\u00e9rence \u00e9diteur",
"revision_date": "2024-09-06T00:00:00.000000"
},
{
"description": "Correction d\u0027identifiants CVE erron\u00e9s",
"revision_date": "2024-10-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Secure Analytics. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Secure Analytics",
"vendor_advisories": [
{
"published_at": "2024-09-30",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA86686",
"url": "https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-vulnerabilities-resolved-in-Juniper-Secure-Analytics-in-7-5-0-UP9-IF02"
}
]
}
CERTFR-2024-AVI-0579
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Spectrum | Spectrum Control versions antérieures à 5.4.12 | ||
| IBM | WebSphere | WebSphere Application Server versions 8.5.x antérieures à 8.5.5.25 sans le correctif de sécurité PH61489 | ||
| IBM | WebSphere | WebSphere Application Server versions 9.0.x antérieures à 9.0.5.20 sans le correctif de sécurité PH61489 | ||
| IBM | QRadar | QRadar Deployment Intelligence App versions antérieures à 3.0.14 | ||
| IBM | QRadar | QRadar SIEM versions 7.5.x antérieures à 7.5.0 UP9 | ||
| IBM | Cloud Pak | Cloud Pak for Security versions antérieures à 1.10.23.0 | ||
| IBM | AIX | AIX versions 7.2 et 7.3 sans le correctif de sécurité 9211224a.240708.epkg.Z | ||
| IBM | QRadar | QRadar Suite Software versions antérieures à 1.10.23.0 | ||
| IBM | QRadar | Security QRadar EDR versions antérieures à 3.12.9 | ||
| IBM | VIOS | VIOS versions 3.1 et 4.1 sans le correctif de sécurité 9211224a.240708.epkg.Z | ||
| IBM | QRadar | QRadar WinCollect Agent versions antérieures à 10.1.11 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Spectrum Control versions ant\u00e9rieures \u00e0 5.4.12",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 8.5.x ant\u00e9rieures \u00e0 8.5.5.25 sans le correctif de s\u00e9curit\u00e9 PH61489",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 9.0.x ant\u00e9rieures \u00e0 9.0.5.20 sans le correctif de s\u00e9curit\u00e9 PH61489",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Deployment Intelligence App versions ant\u00e9rieures \u00e0 3.0.14",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP9",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cloud Pak for Security versions ant\u00e9rieures \u00e0 1.10.23.0",
"product": {
"name": "Cloud Pak",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "AIX versions 7.2 et 7.3 sans le correctif de s\u00e9curit\u00e9 9211224a.240708.epkg.Z",
"product": {
"name": "AIX",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Suite Software versions ant\u00e9rieures \u00e0 1.10.23.0",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Security QRadar EDR versions ant\u00e9rieures \u00e0 3.12.9",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "VIOS versions 3.1 et 4.1 sans le correctif de s\u00e9curit\u00e9 9211224a.240708.epkg.Z",
"product": {
"name": "VIOS",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar WinCollect Agent versions ant\u00e9rieures \u00e0 10.1.11",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-29483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29483"
},
{
"name": "CVE-2024-1597",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1597"
},
{
"name": "CVE-2024-29041",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29041"
},
{
"name": "CVE-2024-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28834"
},
{
"name": "CVE-2024-28849",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28849"
},
{
"name": "CVE-2024-35154",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35154"
},
{
"name": "CVE-2024-4068",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4068"
},
{
"name": "CVE-2024-33602",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33602"
},
{
"name": "CVE-2024-22353",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22353"
},
{
"name": "CVE-2024-3772",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3772"
},
{
"name": "CVE-2023-50312",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50312"
},
{
"name": "CVE-2024-2466",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2466"
},
{
"name": "CVE-2024-28102",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28102"
},
{
"name": "CVE-2024-34069",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34069"
},
{
"name": "CVE-2019-11358",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
},
{
"name": "CVE-2020-15778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15778"
},
{
"name": "CVE-2024-34997",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34997"
},
{
"name": "CVE-2022-3287",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3287"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-29857",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29857"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2024-33600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33600"
},
{
"name": "CVE-2023-45802",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45802"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2024-25026",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25026"
},
{
"name": "CVE-2024-34062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34062"
},
{
"name": "CVE-2024-33599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33599"
},
{
"name": "CVE-2024-4067",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4067"
},
{
"name": "CVE-2024-30172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2024-28176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28176"
},
{
"name": "CVE-2024-1135",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1135"
},
{
"name": "CVE-2020-23064",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
},
{
"name": "CVE-2023-6918",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6918"
},
{
"name": "CVE-2024-2379",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2379"
},
{
"name": "CVE-2024-22329",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22329"
},
{
"name": "CVE-2024-0450",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0450"
},
{
"name": "CVE-2024-2004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2004"
},
{
"name": "CVE-2023-45803",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"name": "CVE-2023-31122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31122"
},
{
"name": "CVE-2024-35195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
},
{
"name": "CVE-2023-51775",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
},
{
"name": "CVE-2024-33601",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33601"
},
{
"name": "CVE-2024-3019",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3019"
},
{
"name": "CVE-2024-5206",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5206"
},
{
"name": "CVE-2024-27088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27088"
},
{
"name": "CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"name": "CVE-2024-25062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25062"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2024-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26461"
},
{
"name": "CVE-2024-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26458"
},
{
"name": "CVE-2023-44483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44483"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2020-11022",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
},
{
"name": "CVE-2024-28863",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28863"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2024-27270",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27270"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2024-30171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30171"
},
{
"name": "CVE-2024-4741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"name": "CVE-2023-46158",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46158"
},
{
"name": "CVE-2024-34064",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34064"
},
{
"name": "CVE-2024-6387",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
},
{
"name": "CVE-2024-25023",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25023"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2023-5752",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5752"
},
{
"name": "CVE-2024-2961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2961"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2023-6597",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6597"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0579",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159768",
"url": "https://www.ibm.com/support/pages/node/7159768"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160017",
"url": "https://www.ibm.com/support/pages/node/7160017"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159781",
"url": "https://www.ibm.com/support/pages/node/7159781"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160014",
"url": "https://www.ibm.com/support/pages/node/7160014"
},
{
"published_at": "2024-07-12",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160134",
"url": "https://www.ibm.com/support/pages/node/7160134"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159771",
"url": "https://www.ibm.com/support/pages/node/7159771"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159867",
"url": "https://www.ibm.com/support/pages/node/7159867"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159865",
"url": "https://www.ibm.com/support/pages/node/7159865"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159527",
"url": "https://www.ibm.com/support/pages/node/7159527"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159825",
"url": "https://www.ibm.com/support/pages/node/7159825"
},
{
"published_at": "2024-07-10",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159934",
"url": "https://www.ibm.com/support/pages/node/7159934"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159920",
"url": "https://www.ibm.com/support/pages/node/7159920"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160013",
"url": "https://www.ibm.com/support/pages/node/7160013"
}
]
}
CERTFR-2025-AVI-0855
Vulnerability from certfr_avis - Published: 2025-10-09 - Updated: 2025-10-09
De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | Junos OS | Junos OS versions 24.4 antérieures à 24.4R2 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions antérieures à 22.4R3-S8-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions 23.4 antérieures à 23.4R2-S5 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 23.2-EVO antérieures à 23.2R2-S4-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions antérieures à 22.4R3-S8 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 24.2-EVO antérieures à 24.2R2-S2-EVO | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 24.4-EVO antérieures à 24.4R2-EVO | ||
| Juniper Networks | Junos Space | Junos Space versions antérieures à 24.1R4 | ||
| Juniper Networks | Security Director | Security Director Policy Enforcer versions antérieures à 23.1R1 Hotpatch v3 | ||
| Juniper Networks | Junos Space | Junos Space Security Director versions antérieures à 24.1R4 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 23.4-EVO antérieures à 23.4R2-S5-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions 23.2 antérieures à 23.2R2-S4 | ||
| Juniper Networks | Junos OS | Junos OS versions 24.2 antérieures à 24.2R2-S1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Junos OS versions 24.4 ant\u00e9rieures \u00e0 24.4R2",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions ant\u00e9rieures \u00e0 22.4R3-S8-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 23.4 ant\u00e9rieures \u00e0 23.4R2-S5",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 23.2-EVO ant\u00e9rieures \u00e0 23.2R2-S4-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions ant\u00e9rieures \u00e0 22.4R3-S8",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 24.2-EVO ant\u00e9rieures \u00e0 24.2R2-S2-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 24.4-EVO ant\u00e9rieures \u00e0 24.4R2-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos Space versions ant\u00e9rieures \u00e0 24.1R4",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Security Director Policy Enforcer versions ant\u00e9rieures \u00e0 23.1R1 Hotpatch v3",
"product": {
"name": "Security Director",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos Space Security Director versions ant\u00e9rieures \u00e0 24.1R4",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 23.4-EVO ant\u00e9rieures \u00e0 23.4R2-S5-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 23.2 ant\u00e9rieures \u00e0 23.2R2-S4",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 24.2 ant\u00e9rieures \u00e0 24.2R2-S1",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-24795",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
},
{
"name": "CVE-2024-36903",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36903"
},
{
"name": "CVE-2023-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44431"
},
{
"name": "CVE-2021-47606",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47606"
},
{
"name": "CVE-2025-59993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59993"
},
{
"name": "CVE-2025-59997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59997"
},
{
"name": "CVE-2023-7104",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7104"
},
{
"name": "CVE-2025-59995",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59995"
},
{
"name": "CVE-2024-21235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21235"
},
{
"name": "CVE-2023-28466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28466"
},
{
"name": "CVE-2024-36921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36921"
},
{
"name": "CVE-2025-59986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59986"
},
{
"name": "CVE-2025-60009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60009"
},
{
"name": "CVE-2025-59989",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59989"
},
{
"name": "CVE-2024-26897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26897"
},
{
"name": "CVE-2023-46103",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46103"
},
{
"name": "CVE-2024-27052",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27052"
},
{
"name": "CVE-2023-2235",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2235"
},
{
"name": "CVE-2025-59999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59999"
},
{
"name": "CVE-2025-59994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59994"
},
{
"name": "CVE-2024-4076",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4076"
},
{
"name": "CVE-2025-59967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59967"
},
{
"name": "CVE-2022-24805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24805"
},
{
"name": "CVE-2024-12797",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12797"
},
{
"name": "CVE-2023-3390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3390"
},
{
"name": "CVE-2024-37356",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37356"
},
{
"name": "CVE-2024-47538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47538"
},
{
"name": "CVE-2023-4004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4004"
},
{
"name": "CVE-2024-21823",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21823"
},
{
"name": "CVE-2025-59991",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59991"
},
{
"name": "CVE-2024-5564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5564"
},
{
"name": "CVE-2024-26600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26600"
},
{
"name": "CVE-2023-28746",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28746"
},
{
"name": "CVE-2023-52864",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52864"
},
{
"name": "CVE-2025-26600",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26600"
},
{
"name": "CVE-2024-3596",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3596"
},
{
"name": "CVE-2024-27280",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27280"
},
{
"name": "CVE-2024-36929",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36929"
},
{
"name": "CVE-2023-35788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35788"
},
{
"name": "CVE-2025-59982",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59982"
},
{
"name": "CVE-2024-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1975"
},
{
"name": "CVE-2023-43785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43785"
},
{
"name": "CVE-2024-30205",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30205"
},
{
"name": "CVE-2018-17247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17247"
},
{
"name": "CVE-2025-60004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60004"
},
{
"name": "CVE-2023-51594",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51594"
},
{
"name": "CVE-2024-22025",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22025"
},
{
"name": "CVE-2023-50229",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50229"
},
{
"name": "CVE-2025-59974",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59974"
},
{
"name": "CVE-2025-26598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26598"
},
{
"name": "CVE-2018-3824",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3824"
},
{
"name": "CVE-2024-40928",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40928"
},
{
"name": "CVE-2024-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
},
{
"name": "CVE-2024-8508",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8508"
},
{
"name": "CVE-2024-36020",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36020"
},
{
"name": "CVE-2021-45105",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
},
{
"name": "CVE-2025-59981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59981"
},
{
"name": "CVE-2023-31248",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31248"
},
{
"name": "CVE-2024-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1737"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2021-4104",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
},
{
"name": "CVE-2024-30203",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30203"
},
{
"name": "CVE-2023-3090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3090"
},
{
"name": "CVE-2024-35937",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35937"
},
{
"name": "CVE-2025-59968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59968"
},
{
"name": "CVE-2023-51592",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51592"
},
{
"name": "CVE-2025-59990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59990"
},
{
"name": "CVE-2021-22146",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22146"
},
{
"name": "CVE-2025-59978",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59978"
},
{
"name": "CVE-2024-25629",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25629"
},
{
"name": "CVE-2024-36017",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36017"
},
{
"name": "CVE-2024-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24806"
},
{
"name": "CVE-2024-27434",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27434"
},
{
"name": "CVE-2023-47038",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47038"
},
{
"name": "CVE-2024-35852",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35852"
},
{
"name": "CVE-2024-38558",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38558"
},
{
"name": "CVE-2025-59992",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59992"
},
{
"name": "CVE-2024-35845",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35845"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2025-60000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60000"
},
{
"name": "CVE-2022-24807",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24807"
},
{
"name": "CVE-2024-47607",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47607"
},
{
"name": "CVE-2024-27065",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27065"
},
{
"name": "CVE-2024-36005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36005"
},
{
"name": "CVE-2023-45866",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45866"
},
{
"name": "CVE-2023-27349",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27349"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2015-5377",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5377"
},
{
"name": "CVE-2023-48161",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48161"
},
{
"name": "CVE-2022-24810",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24810"
},
{
"name": "CVE-2024-33621",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33621"
},
{
"name": "CVE-2024-27983",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27983"
},
{
"name": "CVE-2025-60001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60001"
},
{
"name": "CVE-2024-5742",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5742"
},
{
"name": "CVE-2023-50230",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50230"
},
{
"name": "CVE-2025-52960",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52960"
},
{
"name": "CVE-2024-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36922"
},
{
"name": "CVE-2025-59996",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59996"
},
{
"name": "CVE-2024-39487",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39487"
},
{
"name": "CVE-2024-27982",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27982"
},
{
"name": "CVE-2023-38575",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38575"
},
{
"name": "CVE-2024-35911",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35911"
},
{
"name": "CVE-2025-59957",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59957"
},
{
"name": "CVE-2025-59958",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59958"
},
{
"name": "CVE-2021-41043",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41043"
},
{
"name": "CVE-2018-17244",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17244"
},
{
"name": "CVE-2019-12900",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12900"
},
{
"name": "CVE-2024-39908",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39908"
},
{
"name": "CVE-2025-26597",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26597"
},
{
"name": "CVE-2024-36971",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36971"
},
{
"name": "CVE-2023-2603",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2603"
},
{
"name": "CVE-2024-41946",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41946"
},
{
"name": "CVE-2023-3776",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3776"
},
{
"name": "CVE-2024-42934",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42934"
},
{
"name": "CVE-2023-51580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51580"
},
{
"name": "CVE-2024-35848",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35848"
},
{
"name": "CVE-2024-27417",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27417"
},
{
"name": "CVE-2023-21102",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21102"
},
{
"name": "CVE-2024-27281",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27281"
},
{
"name": "CVE-2025-59983",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59983"
},
{
"name": "CVE-2024-36941",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36941"
},
{
"name": "CVE-2024-2236",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2236"
},
{
"name": "CVE-2024-38428",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38428"
},
{
"name": "CVE-2024-35969",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35969"
},
{
"name": "CVE-2021-45046",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
},
{
"name": "CVE-2025-60006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60006"
},
{
"name": "CVE-2024-36489",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36489"
},
{
"name": "CVE-2015-1427",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1427"
},
{
"name": "CVE-2024-38575",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38575"
},
{
"name": "CVE-2024-35899",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35899"
},
{
"name": "CVE-2024-35823",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35823"
},
{
"name": "CVE-2024-40954",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40954"
},
{
"name": "CVE-2024-9632",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9632"
},
{
"name": "CVE-2023-38408",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38408"
},
{
"name": "CVE-2025-26595",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26595"
},
{
"name": "CVE-2024-26868",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26868"
},
{
"name": "CVE-2023-43787",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43787"
},
{
"name": "CVE-2023-43786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43786"
},
{
"name": "CVE-2024-8235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8235"
},
{
"name": "CVE-2023-4147",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4147"
},
{
"name": "CVE-2025-59977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59977"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2023-3610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3610"
},
{
"name": "CVE-2025-26596",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26596"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2022-48622",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48622"
},
{
"name": "CVE-2021-42550",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42550"
},
{
"name": "CVE-2021-44228",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"name": "CVE-2024-26828",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26828"
},
{
"name": "CVE-2025-59998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59998"
},
{
"name": "CVE-2024-26808",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26808"
},
{
"name": "CVE-2024-30204",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30204"
},
{
"name": "CVE-2025-60002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60002"
},
{
"name": "CVE-2023-35001",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35001"
},
{
"name": "CVE-2024-27282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27282"
},
{
"name": "CVE-2018-3831",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3831"
},
{
"name": "CVE-2023-43490",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43490"
},
{
"name": "CVE-2025-59976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59976"
},
{
"name": "CVE-2025-59980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59980"
},
{
"name": "CVE-2025-26599",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26599"
},
{
"name": "CVE-2024-47615",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47615"
},
{
"name": "CVE-2018-3823",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3823"
},
{
"name": "CVE-2023-22655",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22655"
},
{
"name": "CVE-2024-6126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6126"
},
{
"name": "CVE-2023-4911",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4911"
},
{
"name": "CVE-2023-39368",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39368"
},
{
"name": "CVE-2021-44832",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
},
{
"name": "CVE-2024-26853",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26853"
},
{
"name": "CVE-2025-59975",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59975"
},
{
"name": "CVE-2025-0624",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0624"
},
{
"name": "CVE-2025-59987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59987"
},
{
"name": "CVE-2024-40958",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40958"
},
{
"name": "CVE-2018-3826",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3826"
},
{
"name": "CVE-2025-26601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26601"
},
{
"name": "CVE-2024-52337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52337"
},
{
"name": "CVE-2025-59985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59985"
},
{
"name": "CVE-2025-11198",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11198"
},
{
"name": "CVE-2022-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24806"
},
{
"name": "CVE-2023-32233",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32233"
},
{
"name": "CVE-2024-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35789"
},
{
"name": "CVE-2024-26327",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26327"
},
{
"name": "CVE-2015-3253",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
},
{
"name": "CVE-2025-59964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59964"
},
{
"name": "CVE-2025-59988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59988"
},
{
"name": "CVE-2024-21210",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21210"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2024-34397",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34397"
},
{
"name": "CVE-2023-45733",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45733"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2024-6655",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6655"
},
{
"name": "CVE-2024-41123",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41123"
},
{
"name": "CVE-2024-27049",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27049"
},
{
"name": "CVE-2025-59984",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59984"
},
{
"name": "CVE-2025-52961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52961"
},
{
"name": "CVE-2023-51589",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51589"
},
{
"name": "CVE-2024-21217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21217"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2021-3903",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3903"
},
{
"name": "CVE-2024-35800",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35800"
},
{
"name": "CVE-2023-2124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2124"
},
{
"name": "CVE-2023-51596",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51596"
},
{
"name": "CVE-2025-60010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60010"
},
{
"name": "CVE-2023-51764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51764"
},
{
"name": "CVE-2025-26594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26594"
},
{
"name": "CVE-2024-6409",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6409"
},
{
"name": "CVE-2024-49761",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
},
{
"name": "CVE-2022-24808",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24808"
},
{
"name": "CVE-2025-59962",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59962"
},
{
"name": "CVE-2024-21208",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21208"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"name": "CVE-2024-40961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40961"
}
],
"initial_release_date": "2025-10-09T00:00:00",
"last_revision_date": "2025-10-09T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0855",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-10-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper Networks",
"vendor_advisories": [
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103140",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Multiple-XSS-vulnerabilities-resolved-in-24-1R4-release"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103141",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R4-release"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103163",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-Multiple-OS-command-injection-vulnerabilities-fixed-CVE-2025-60006"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103168",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Device-allows-login-for-user-with-expired-password-CVE-2025-60010"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103171",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Reflected-client-side-HTTP-parameter-pollution-vulnerability-in-web-interface-CVE-2025-59977"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103167",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-When-a-user-with-the-name-ftp-or-anonymous-is-configured-unauthenticated-filesystem-access-is-allowed-CVE-2025-59980"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103156",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-ACX7024-ACX7024X-ACX7100-32C-ACX7100-48L-ACX7348-ACX7509-When-specific-valid-multicast-traffic-is-received-on-the-L3-interface-a-vulnerable-device-evo-pfemand-crashes-and-restarts-CVE-2025-59967"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103437",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Security-Director-Policy-Enforcer-An-unrestricted-API-allows-a-network-based-unauthenticated-attacker-to-deploy-malicious-vSRX-images-to-VMWare-NSX-Server-CVE-2025-11198"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103172",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Flooding-device-with-inbound-API-calls-leads-to-WebUI-and-CLI-management-access-DoS-CVE-2025-59975"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103157",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Juniper-Security-Director-Insufficient-authorization-for-sensitive-resources-in-web-interface-CVE-2025-59968"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103170",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Arbitrary-file-download-vulnerability-in-web-interface-CVE-2025-59976"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103139",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103151",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-sharding-enabled-change-in-indirect-next-hop-can-cause-RPD-crash-CVE-2025-59962"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103153",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX4700-When-forwarding-options-sampling-is-enabled-any-traffic-destined-to-the-RE-will-cause-the-forwarding-line-card-to-crash-and-restart-CVE-2025-59964"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103147",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-When-firewall-filter-rejects-traffic-these-packets-are-erroneously-sent-to-the-RE-CVE-2025-59958"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103144",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-except-PTX10003-An-unauthenticated-adjacent-attacker-sending-specific-valid-traffic-can-cause-a-memory-leak-in-cfmman-leading-to-FPC-crash-and-restart-CVE-2025-52961"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103143",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX-Series-and-MX-Series-Receipt-of-specific-SIP-packets-in-a-high-utilization-situation-causes-a-flowd-crash-CVE-2025-52960"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103146",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-EX4600-Series-and-QFX5000-Series-An-attacker-with-physical-access-can-open-a-persistent-backdoor-CVE-2025-59957"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103138",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4-by-upgrading-Log4j-Java-library-to-2-23-1-and-ElasticSearch-to-6-8-17"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103165",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Specific-BGP-EVPN-update-message-causes-rpd-crash-CVE-2025-60004"
}
]
}
CERTFR-2024-AVI-0579
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Spectrum | Spectrum Control versions antérieures à 5.4.12 | ||
| IBM | WebSphere | WebSphere Application Server versions 8.5.x antérieures à 8.5.5.25 sans le correctif de sécurité PH61489 | ||
| IBM | WebSphere | WebSphere Application Server versions 9.0.x antérieures à 9.0.5.20 sans le correctif de sécurité PH61489 | ||
| IBM | QRadar | QRadar Deployment Intelligence App versions antérieures à 3.0.14 | ||
| IBM | QRadar | QRadar SIEM versions 7.5.x antérieures à 7.5.0 UP9 | ||
| IBM | Cloud Pak | Cloud Pak for Security versions antérieures à 1.10.23.0 | ||
| IBM | AIX | AIX versions 7.2 et 7.3 sans le correctif de sécurité 9211224a.240708.epkg.Z | ||
| IBM | QRadar | QRadar Suite Software versions antérieures à 1.10.23.0 | ||
| IBM | QRadar | Security QRadar EDR versions antérieures à 3.12.9 | ||
| IBM | VIOS | VIOS versions 3.1 et 4.1 sans le correctif de sécurité 9211224a.240708.epkg.Z | ||
| IBM | QRadar | QRadar WinCollect Agent versions antérieures à 10.1.11 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Spectrum Control versions ant\u00e9rieures \u00e0 5.4.12",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 8.5.x ant\u00e9rieures \u00e0 8.5.5.25 sans le correctif de s\u00e9curit\u00e9 PH61489",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 9.0.x ant\u00e9rieures \u00e0 9.0.5.20 sans le correctif de s\u00e9curit\u00e9 PH61489",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Deployment Intelligence App versions ant\u00e9rieures \u00e0 3.0.14",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP9",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cloud Pak for Security versions ant\u00e9rieures \u00e0 1.10.23.0",
"product": {
"name": "Cloud Pak",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "AIX versions 7.2 et 7.3 sans le correctif de s\u00e9curit\u00e9 9211224a.240708.epkg.Z",
"product": {
"name": "AIX",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Suite Software versions ant\u00e9rieures \u00e0 1.10.23.0",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Security QRadar EDR versions ant\u00e9rieures \u00e0 3.12.9",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "VIOS versions 3.1 et 4.1 sans le correctif de s\u00e9curit\u00e9 9211224a.240708.epkg.Z",
"product": {
"name": "VIOS",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar WinCollect Agent versions ant\u00e9rieures \u00e0 10.1.11",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-29483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29483"
},
{
"name": "CVE-2024-1597",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1597"
},
{
"name": "CVE-2024-29041",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29041"
},
{
"name": "CVE-2024-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28834"
},
{
"name": "CVE-2024-28849",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28849"
},
{
"name": "CVE-2024-35154",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35154"
},
{
"name": "CVE-2024-4068",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4068"
},
{
"name": "CVE-2024-33602",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33602"
},
{
"name": "CVE-2024-22353",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22353"
},
{
"name": "CVE-2024-3772",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3772"
},
{
"name": "CVE-2023-50312",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50312"
},
{
"name": "CVE-2024-2466",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2466"
},
{
"name": "CVE-2024-28102",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28102"
},
{
"name": "CVE-2024-34069",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34069"
},
{
"name": "CVE-2019-11358",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
},
{
"name": "CVE-2020-15778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15778"
},
{
"name": "CVE-2024-34997",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34997"
},
{
"name": "CVE-2022-3287",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3287"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-29857",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29857"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2024-33600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33600"
},
{
"name": "CVE-2023-45802",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45802"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2024-25026",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25026"
},
{
"name": "CVE-2024-34062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34062"
},
{
"name": "CVE-2024-33599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33599"
},
{
"name": "CVE-2024-4067",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4067"
},
{
"name": "CVE-2024-30172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2024-28176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28176"
},
{
"name": "CVE-2024-1135",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1135"
},
{
"name": "CVE-2020-23064",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
},
{
"name": "CVE-2023-6918",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6918"
},
{
"name": "CVE-2024-2379",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2379"
},
{
"name": "CVE-2024-22329",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22329"
},
{
"name": "CVE-2024-0450",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0450"
},
{
"name": "CVE-2024-2004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2004"
},
{
"name": "CVE-2023-45803",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"name": "CVE-2023-31122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31122"
},
{
"name": "CVE-2024-35195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
},
{
"name": "CVE-2023-51775",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
},
{
"name": "CVE-2024-33601",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33601"
},
{
"name": "CVE-2024-3019",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3019"
},
{
"name": "CVE-2024-5206",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5206"
},
{
"name": "CVE-2024-27088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27088"
},
{
"name": "CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"name": "CVE-2024-25062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25062"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2024-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26461"
},
{
"name": "CVE-2024-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26458"
},
{
"name": "CVE-2023-44483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44483"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2020-11022",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
},
{
"name": "CVE-2024-28863",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28863"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2024-27270",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27270"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2024-30171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30171"
},
{
"name": "CVE-2024-4741",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"name": "CVE-2023-46158",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46158"
},
{
"name": "CVE-2024-34064",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34064"
},
{
"name": "CVE-2024-6387",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
},
{
"name": "CVE-2024-25023",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25023"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2023-5752",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5752"
},
{
"name": "CVE-2024-2961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2961"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2023-6597",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6597"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0579",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159768",
"url": "https://www.ibm.com/support/pages/node/7159768"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160017",
"url": "https://www.ibm.com/support/pages/node/7160017"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159781",
"url": "https://www.ibm.com/support/pages/node/7159781"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160014",
"url": "https://www.ibm.com/support/pages/node/7160014"
},
{
"published_at": "2024-07-12",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160134",
"url": "https://www.ibm.com/support/pages/node/7160134"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159771",
"url": "https://www.ibm.com/support/pages/node/7159771"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159867",
"url": "https://www.ibm.com/support/pages/node/7159867"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159865",
"url": "https://www.ibm.com/support/pages/node/7159865"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159527",
"url": "https://www.ibm.com/support/pages/node/7159527"
},
{
"published_at": "2024-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159825",
"url": "https://www.ibm.com/support/pages/node/7159825"
},
{
"published_at": "2024-07-10",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159934",
"url": "https://www.ibm.com/support/pages/node/7159934"
},
{
"published_at": "2024-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159920",
"url": "https://www.ibm.com/support/pages/node/7159920"
},
{
"published_at": "2024-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7160013",
"url": "https://www.ibm.com/support/pages/node/7160013"
}
]
}
CERTFR-2024-AVI-0741
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Juniper Secure Analytics. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | Secure Analytics | Juniper Secure Analytics versions antérieures à 7.5.0 UP9 IF02 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Juniper Secure Analytics versions ant\u00e9rieures \u00e0 7.5.0 UP9 IF02",
"product": {
"name": "Secure Analytics",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-29483",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29483"
},
{
"name": "CVE-2024-42472",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42472"
},
{
"name": "CVE-2024-26934",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26934"
},
{
"name": "CVE-2023-52477",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52477"
},
{
"name": "CVE-2023-52675",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52675"
},
{
"name": "CVE-2023-4692",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4692"
},
{
"name": "CVE-2024-27059",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27059"
},
{
"name": "CVE-2024-26656",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26656"
},
{
"name": "CVE-2024-28834",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28834"
},
{
"name": "CVE-2023-38264",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38264"
},
{
"name": "CVE-2024-26974",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26974"
},
{
"name": "CVE-2024-26897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26897"
},
{
"name": "CVE-2021-47055",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47055"
},
{
"name": "CVE-2020-36777",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36777"
},
{
"name": "CVE-2023-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43788"
},
{
"name": "CVE-2024-27052",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27052"
},
{
"name": "CVE-2023-52425",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
},
{
"name": "CVE-2024-26585",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26585"
},
{
"name": "CVE-2024-25744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25744"
},
{
"name": "CVE-2024-26973",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26973"
},
{
"name": "CVE-2024-33602",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33602"
},
{
"name": "CVE-2024-27397",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27397"
},
{
"name": "CVE-2024-35854",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35854"
},
{
"name": "CVE-2023-52878",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52878"
},
{
"name": "CVE-2021-47185",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47185"
},
{
"name": "CVE-2024-23650",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23650"
},
{
"name": "CVE-2024-26603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26603"
},
{
"name": "CVE-2024-26964",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26964"
},
{
"name": "CVE-2024-5564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5564"
},
{
"name": "CVE-2021-33198",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33198"
},
{
"name": "CVE-2024-26993",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26993"
},
{
"name": "CVE-2019-25162",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-25162"
},
{
"name": "CVE-2022-41715",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41715"
},
{
"name": "CVE-2023-39321",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39321"
},
{
"name": "CVE-2024-3933",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3933"
},
{
"name": "CVE-2024-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1975"
},
{
"name": "CVE-2023-52669",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52669"
},
{
"name": "CVE-2019-11358",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
},
{
"name": "CVE-2020-15778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15778"
},
{
"name": "CVE-2022-3287",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3287"
},
{
"name": "CVE-2024-36004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36004"
},
{
"name": "CVE-2024-26859",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26859"
},
{
"name": "CVE-2020-13936",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13936"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2024-29857",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29857"
},
{
"name": "CVE-2024-35959",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35959"
},
{
"name": "CVE-2018-20060",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20060"
},
{
"name": "CVE-2024-35855",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35855"
},
{
"name": "CVE-2024-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1737"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2024-33600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33600"
},
{
"name": "CVE-2024-3652",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3652"
},
{
"name": "CVE-2024-26615",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26615"
},
{
"name": "CVE-2023-45802",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45802"
},
{
"name": "CVE-2024-26801",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26801"
},
{
"name": "CVE-2024-36007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36007"
},
{
"name": "CVE-2021-47311",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47311"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2024-26643",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26643"
},
{
"name": "CVE-2024-26779",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26779"
},
{
"name": "CVE-2024-32021",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32021"
},
{
"name": "CVE-2024-33599",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33599"
},
{
"name": "CVE-2024-25629",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25629"
},
{
"name": "CVE-2024-28180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28180"
},
{
"name": "CVE-2024-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24806"
},
{
"name": "CVE-2024-35852",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35852"
},
{
"name": "CVE-2024-23307",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23307"
},
{
"name": "CVE-2024-30172",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
},
{
"name": "CVE-2023-52528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52528"
},
{
"name": "CVE-2024-27048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27048"
},
{
"name": "CVE-2021-47013",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47013"
},
{
"name": "CVE-2023-52781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52781"
},
{
"name": "CVE-2024-35845",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35845"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2023-48795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48795"
},
{
"name": "CVE-2021-47073",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47073"
},
{
"name": "CVE-2024-26804",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26804"
},
{
"name": "CVE-2024-26593",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26593"
},
{
"name": "CVE-2022-48627",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48627"
},
{
"name": "CVE-2021-47171",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47171"
},
{
"name": "CVE-2024-26743",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26743"
},
{
"name": "CVE-2023-52686",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52686"
},
{
"name": "CVE-2021-47236",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47236"
},
{
"name": "CVE-2023-39318",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39318"
},
{
"name": "CVE-2023-6240",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6240"
},
{
"name": "CVE-2024-32004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32004"
},
{
"name": "CVE-2021-47118",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47118"
},
{
"name": "CVE-2024-35890",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35890"
},
{
"name": "CVE-2020-23064",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
},
{
"name": "CVE-2023-6918",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6918"
},
{
"name": "CVE-2024-22195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22195"
},
{
"name": "CVE-2023-52877",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52877"
},
{
"name": "CVE-2024-21011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
},
{
"name": "CVE-2024-32020",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32020"
},
{
"name": "CVE-2024-0450",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0450"
},
{
"name": "CVE-2023-45803",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"name": "CVE-2023-39319",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39319"
},
{
"name": "CVE-2024-32487",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32487"
},
{
"name": "CVE-2024-26826",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26826"
},
{
"name": "CVE-2024-27056",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27056"
},
{
"name": "CVE-2024-26583",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26583"
},
{
"name": "CVE-2024-26642",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26642"
},
{
"name": "CVE-2021-47153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47153"
},
{
"name": "CVE-2024-35888",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35888"
},
{
"name": "CVE-2023-52700",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52700"
},
{
"name": "CVE-2023-31122",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31122"
},
{
"name": "CVE-2023-52439",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52439"
},
{
"name": "CVE-2021-47495",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47495"
},
{
"name": "CVE-2024-26675",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26675"
},
{
"name": "CVE-2019-14865",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14865"
},
{
"name": "CVE-2024-26906",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26906"
},
{
"name": "CVE-2024-26610",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26610"
},
{
"name": "CVE-2024-2357",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2357"
},
{
"name": "CVE-2024-26584",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26584"
},
{
"name": "CVE-2024-21094",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
},
{
"name": "CVE-2024-26919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26919"
},
{
"name": "CVE-2023-52445",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52445"
},
{
"name": "CVE-2024-33601",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33601"
},
{
"name": "CVE-2024-3019",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3019"
},
{
"name": "CVE-2022-2880",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2880"
},
{
"name": "CVE-2024-27014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27014"
},
{
"name": "CVE-2021-34558",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34558"
},
{
"name": "CVE-2024-32465",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32465"
},
{
"name": "CVE-2024-22365",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22365"
},
{
"name": "CVE-2023-43804",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43804"
},
{
"name": "CVE-2023-43789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43789"
},
{
"name": "CVE-2024-38428",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38428"
},
{
"name": "CVE-2024-25062",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25062"
},
{
"name": "CVE-2022-2879",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2879"
},
{
"name": "CVE-2024-2398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2398"
},
{
"name": "CVE-2024-26892",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26892"
},
{
"name": "CVE-2024-35835",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35835"
},
{
"name": "CVE-2024-26735",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26735"
},
{
"name": "CVE-2023-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52881"
},
{
"name": "CVE-2023-4693",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4693"
},
{
"name": "CVE-2021-46972",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46972"
},
{
"name": "CVE-2023-52578",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52578"
},
{
"name": "CVE-2024-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26461"
},
{
"name": "CVE-2024-34750",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34750"
},
{
"name": "CVE-2024-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26458"
},
{
"name": "CVE-2021-46934",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46934"
},
{
"name": "CVE-2024-1048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1048"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2023-52598",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52598"
},
{
"name": "CVE-2020-11022",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
},
{
"name": "CVE-2023-7008",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7008"
},
{
"name": "CVE-2024-26659",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26659"
},
{
"name": "CVE-2023-52667",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52667"
},
{
"name": "CVE-2024-26933",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26933"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2023-52703",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52703"
},
{
"name": "CVE-2023-52594",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52594"
},
{
"name": "CVE-2024-26693",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26693"
},
{
"name": "CVE-2023-52595",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52595"
},
{
"name": "CVE-2024-30171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30171"
},
{
"name": "CVE-2023-45287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
},
{
"name": "CVE-2022-48624",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48624"
},
{
"name": "CVE-2024-26759",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26759"
},
{
"name": "CVE-2023-52464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52464"
},
{
"name": "CVE-2023-52813",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52813"
},
{
"name": "CVE-2024-35838",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35838"
},
{
"name": "CVE-2023-52513",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52513"
},
{
"name": "CVE-2023-52615",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52615"
},
{
"name": "CVE-2023-52610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52610"
},
{
"name": "CVE-2023-52560",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52560"
},
{
"name": "CVE-2024-3651",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3651"
},
{
"name": "CVE-2023-39322",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39322"
},
{
"name": "CVE-2023-52606",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52606"
},
{
"name": "CVE-2021-47069",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47069"
},
{
"name": "CVE-2024-35960",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35960"
},
{
"name": "CVE-2022-39253",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39253"
},
{
"name": "CVE-2024-34064",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34064"
},
{
"name": "CVE-2023-2953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2953"
},
{
"name": "CVE-2024-26872",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26872"
},
{
"name": "CVE-2020-26555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
},
{
"name": "CVE-2024-26901",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26901"
},
{
"name": "CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"name": "CVE-2024-21085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
},
{
"name": "CVE-2023-29409",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29409"
},
{
"name": "CVE-2024-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35789"
},
{
"name": "CVE-2023-52835",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52835"
},
{
"name": "CVE-2024-26982",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26982"
},
{
"name": "CVE-2021-47310",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47310"
},
{
"name": "CVE-2023-52626",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52626"
},
{
"name": "CVE-2024-0340",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0340"
},
{
"name": "CVE-2024-26744",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26744"
},
{
"name": "CVE-2024-24786",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
},
{
"name": "CVE-2024-35958",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35958"
},
{
"name": "CVE-2021-47456",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47456"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2024-32002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-32002"
},
{
"name": "CVE-2022-48669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48669"
},
{
"name": "CVE-2023-52565",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52565"
},
{
"name": "CVE-2023-52520",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52520"
},
{
"name": "CVE-2021-47356",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47356"
},
{
"name": "CVE-2024-26694",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26694"
},
{
"name": "CVE-2024-2961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2961"
},
{
"name": "CVE-2024-26664",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26664"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2021-47353",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47353"
},
{
"name": "CVE-2023-6597",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6597"
},
{
"name": "CVE-2023-52607",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52607"
},
{
"name": "CVE-2024-6345",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"name": "CVE-2018-25091",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25091"
},
{
"name": "CVE-2023-5090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5090"
},
{
"name": "CVE-2024-27410",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27410"
},
{
"name": "CVE-2021-46909",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-46909"
},
{
"name": "CVE-2024-35853",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35853"
},
{
"name": "CVE-2024-26907",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26907"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0741",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-05T00:00:00.000000"
},
{
"description": "Ajout r\u00e9f\u00e9rence \u00e9diteur",
"revision_date": "2024-09-06T00:00:00.000000"
},
{
"description": "Correction d\u0027identifiants CVE erron\u00e9s",
"revision_date": "2024-10-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Secure Analytics. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Secure Analytics",
"vendor_advisories": [
{
"published_at": "2024-09-30",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA86686",
"url": "https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-vulnerabilities-resolved-in-Juniper-Secure-Analytics-in-7-5-0-UP9-IF02"
}
]
}
CERTFR-2025-AVI-0855
Vulnerability from certfr_avis - Published: 2025-10-09 - Updated: 2025-10-09
De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | Junos OS | Junos OS versions 24.4 antérieures à 24.4R2 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions antérieures à 22.4R3-S8-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions 23.4 antérieures à 23.4R2-S5 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 23.2-EVO antérieures à 23.2R2-S4-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions antérieures à 22.4R3-S8 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 24.2-EVO antérieures à 24.2R2-S2-EVO | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 24.4-EVO antérieures à 24.4R2-EVO | ||
| Juniper Networks | Junos Space | Junos Space versions antérieures à 24.1R4 | ||
| Juniper Networks | Security Director | Security Director Policy Enforcer versions antérieures à 23.1R1 Hotpatch v3 | ||
| Juniper Networks | Junos Space | Junos Space Security Director versions antérieures à 24.1R4 | ||
| Juniper Networks | Junos OS Evolved | Junos OS Evolved versions 23.4-EVO antérieures à 23.4R2-S5-EVO | ||
| Juniper Networks | Junos OS | Junos OS versions 23.2 antérieures à 23.2R2-S4 | ||
| Juniper Networks | Junos OS | Junos OS versions 24.2 antérieures à 24.2R2-S1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Junos OS versions 24.4 ant\u00e9rieures \u00e0 24.4R2",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions ant\u00e9rieures \u00e0 22.4R3-S8-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 23.4 ant\u00e9rieures \u00e0 23.4R2-S5",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 23.2-EVO ant\u00e9rieures \u00e0 23.2R2-S4-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions ant\u00e9rieures \u00e0 22.4R3-S8",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 24.2-EVO ant\u00e9rieures \u00e0 24.2R2-S2-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 24.4-EVO ant\u00e9rieures \u00e0 24.4R2-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos Space versions ant\u00e9rieures \u00e0 24.1R4",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Security Director Policy Enforcer versions ant\u00e9rieures \u00e0 23.1R1 Hotpatch v3",
"product": {
"name": "Security Director",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos Space Security Director versions ant\u00e9rieures \u00e0 24.1R4",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS Evolved versions 23.4-EVO ant\u00e9rieures \u00e0 23.4R2-S5-EVO",
"product": {
"name": "Junos OS Evolved",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 23.2 ant\u00e9rieures \u00e0 23.2R2-S4",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
},
{
"description": "Junos OS versions 24.2 ant\u00e9rieures \u00e0 24.2R2-S1",
"product": {
"name": "Junos OS",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-24795",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
},
{
"name": "CVE-2024-36903",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36903"
},
{
"name": "CVE-2023-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44431"
},
{
"name": "CVE-2021-47606",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47606"
},
{
"name": "CVE-2025-59993",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59993"
},
{
"name": "CVE-2025-59997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59997"
},
{
"name": "CVE-2023-7104",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7104"
},
{
"name": "CVE-2025-59995",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59995"
},
{
"name": "CVE-2024-21235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21235"
},
{
"name": "CVE-2023-28466",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28466"
},
{
"name": "CVE-2024-36921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36921"
},
{
"name": "CVE-2025-59986",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59986"
},
{
"name": "CVE-2025-60009",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60009"
},
{
"name": "CVE-2025-59989",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59989"
},
{
"name": "CVE-2024-26897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26897"
},
{
"name": "CVE-2023-46103",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46103"
},
{
"name": "CVE-2024-27052",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27052"
},
{
"name": "CVE-2023-2235",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2235"
},
{
"name": "CVE-2025-59999",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59999"
},
{
"name": "CVE-2025-59994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59994"
},
{
"name": "CVE-2024-4076",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4076"
},
{
"name": "CVE-2025-59967",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59967"
},
{
"name": "CVE-2022-24805",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24805"
},
{
"name": "CVE-2024-12797",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12797"
},
{
"name": "CVE-2023-3390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3390"
},
{
"name": "CVE-2024-37356",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37356"
},
{
"name": "CVE-2024-47538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47538"
},
{
"name": "CVE-2023-4004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4004"
},
{
"name": "CVE-2024-21823",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21823"
},
{
"name": "CVE-2025-59991",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59991"
},
{
"name": "CVE-2024-5564",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5564"
},
{
"name": "CVE-2024-26600",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26600"
},
{
"name": "CVE-2023-28746",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28746"
},
{
"name": "CVE-2023-52864",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52864"
},
{
"name": "CVE-2025-26600",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26600"
},
{
"name": "CVE-2024-3596",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-3596"
},
{
"name": "CVE-2024-27280",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27280"
},
{
"name": "CVE-2024-36929",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36929"
},
{
"name": "CVE-2023-35788",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35788"
},
{
"name": "CVE-2025-59982",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59982"
},
{
"name": "CVE-2024-1975",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1975"
},
{
"name": "CVE-2023-43785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43785"
},
{
"name": "CVE-2024-30205",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30205"
},
{
"name": "CVE-2018-17247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17247"
},
{
"name": "CVE-2025-60004",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60004"
},
{
"name": "CVE-2023-51594",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51594"
},
{
"name": "CVE-2024-22025",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22025"
},
{
"name": "CVE-2023-50229",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50229"
},
{
"name": "CVE-2025-59974",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59974"
},
{
"name": "CVE-2025-26598",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26598"
},
{
"name": "CVE-2018-3824",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3824"
},
{
"name": "CVE-2024-40928",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40928"
},
{
"name": "CVE-2024-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
},
{
"name": "CVE-2024-8508",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8508"
},
{
"name": "CVE-2024-36020",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36020"
},
{
"name": "CVE-2021-45105",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
},
{
"name": "CVE-2025-59981",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59981"
},
{
"name": "CVE-2023-31248",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31248"
},
{
"name": "CVE-2024-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1737"
},
{
"name": "CVE-2023-25193",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25193"
},
{
"name": "CVE-2021-4104",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
},
{
"name": "CVE-2024-30203",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30203"
},
{
"name": "CVE-2023-3090",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3090"
},
{
"name": "CVE-2024-35937",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35937"
},
{
"name": "CVE-2025-59968",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59968"
},
{
"name": "CVE-2023-51592",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51592"
},
{
"name": "CVE-2025-59990",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59990"
},
{
"name": "CVE-2021-22146",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22146"
},
{
"name": "CVE-2025-59978",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59978"
},
{
"name": "CVE-2024-25629",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25629"
},
{
"name": "CVE-2024-36017",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36017"
},
{
"name": "CVE-2024-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24806"
},
{
"name": "CVE-2024-27434",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27434"
},
{
"name": "CVE-2023-47038",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47038"
},
{
"name": "CVE-2024-35852",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35852"
},
{
"name": "CVE-2024-38558",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38558"
},
{
"name": "CVE-2025-59992",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59992"
},
{
"name": "CVE-2024-35845",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35845"
},
{
"name": "CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"name": "CVE-2025-60000",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60000"
},
{
"name": "CVE-2022-24807",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24807"
},
{
"name": "CVE-2024-47607",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47607"
},
{
"name": "CVE-2024-27065",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27065"
},
{
"name": "CVE-2024-36005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36005"
},
{
"name": "CVE-2023-45866",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45866"
},
{
"name": "CVE-2023-27349",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27349"
},
{
"name": "CVE-2023-0464",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"name": "CVE-2015-5377",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5377"
},
{
"name": "CVE-2023-48161",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48161"
},
{
"name": "CVE-2022-24810",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24810"
},
{
"name": "CVE-2024-33621",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33621"
},
{
"name": "CVE-2024-27983",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27983"
},
{
"name": "CVE-2025-60001",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60001"
},
{
"name": "CVE-2024-5742",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5742"
},
{
"name": "CVE-2023-50230",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50230"
},
{
"name": "CVE-2025-52960",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52960"
},
{
"name": "CVE-2024-36922",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36922"
},
{
"name": "CVE-2025-59996",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59996"
},
{
"name": "CVE-2024-39487",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39487"
},
{
"name": "CVE-2024-27982",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27982"
},
{
"name": "CVE-2023-38575",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38575"
},
{
"name": "CVE-2024-35911",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35911"
},
{
"name": "CVE-2025-59957",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59957"
},
{
"name": "CVE-2025-59958",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59958"
},
{
"name": "CVE-2021-41043",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41043"
},
{
"name": "CVE-2018-17244",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-17244"
},
{
"name": "CVE-2019-12900",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12900"
},
{
"name": "CVE-2024-39908",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39908"
},
{
"name": "CVE-2025-26597",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26597"
},
{
"name": "CVE-2024-36971",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36971"
},
{
"name": "CVE-2023-2603",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2603"
},
{
"name": "CVE-2024-41946",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41946"
},
{
"name": "CVE-2023-3776",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3776"
},
{
"name": "CVE-2024-42934",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42934"
},
{
"name": "CVE-2023-51580",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51580"
},
{
"name": "CVE-2024-35848",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35848"
},
{
"name": "CVE-2024-27417",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27417"
},
{
"name": "CVE-2023-21102",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21102"
},
{
"name": "CVE-2024-27281",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27281"
},
{
"name": "CVE-2025-59983",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59983"
},
{
"name": "CVE-2024-36941",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36941"
},
{
"name": "CVE-2024-2236",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2236"
},
{
"name": "CVE-2024-38428",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38428"
},
{
"name": "CVE-2024-35969",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35969"
},
{
"name": "CVE-2021-45046",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
},
{
"name": "CVE-2025-60006",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60006"
},
{
"name": "CVE-2024-36489",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-36489"
},
{
"name": "CVE-2015-1427",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1427"
},
{
"name": "CVE-2024-38575",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38575"
},
{
"name": "CVE-2024-35899",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35899"
},
{
"name": "CVE-2024-35823",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35823"
},
{
"name": "CVE-2024-40954",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40954"
},
{
"name": "CVE-2024-9632",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9632"
},
{
"name": "CVE-2023-38408",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38408"
},
{
"name": "CVE-2025-26595",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26595"
},
{
"name": "CVE-2024-26868",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26868"
},
{
"name": "CVE-2023-43787",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43787"
},
{
"name": "CVE-2023-43786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43786"
},
{
"name": "CVE-2024-8235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8235"
},
{
"name": "CVE-2023-4147",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4147"
},
{
"name": "CVE-2025-59977",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59977"
},
{
"name": "CVE-2023-6004",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6004"
},
{
"name": "CVE-2023-3610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3610"
},
{
"name": "CVE-2025-26596",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26596"
},
{
"name": "CVE-2024-4603",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4603"
},
{
"name": "CVE-2022-48622",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-48622"
},
{
"name": "CVE-2021-42550",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42550"
},
{
"name": "CVE-2021-44228",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
},
{
"name": "CVE-2024-26828",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26828"
},
{
"name": "CVE-2025-59998",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59998"
},
{
"name": "CVE-2024-26808",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26808"
},
{
"name": "CVE-2024-30204",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30204"
},
{
"name": "CVE-2025-60002",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60002"
},
{
"name": "CVE-2023-35001",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35001"
},
{
"name": "CVE-2024-27282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27282"
},
{
"name": "CVE-2018-3831",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3831"
},
{
"name": "CVE-2023-43490",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-43490"
},
{
"name": "CVE-2025-59976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59976"
},
{
"name": "CVE-2025-59980",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59980"
},
{
"name": "CVE-2025-26599",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26599"
},
{
"name": "CVE-2024-47615",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47615"
},
{
"name": "CVE-2018-3823",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3823"
},
{
"name": "CVE-2023-22655",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22655"
},
{
"name": "CVE-2024-6126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6126"
},
{
"name": "CVE-2023-4911",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4911"
},
{
"name": "CVE-2023-39368",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39368"
},
{
"name": "CVE-2021-44832",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
},
{
"name": "CVE-2024-26853",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26853"
},
{
"name": "CVE-2025-59975",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59975"
},
{
"name": "CVE-2025-0624",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0624"
},
{
"name": "CVE-2025-59987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59987"
},
{
"name": "CVE-2024-40958",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40958"
},
{
"name": "CVE-2018-3826",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3826"
},
{
"name": "CVE-2025-26601",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26601"
},
{
"name": "CVE-2024-52337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52337"
},
{
"name": "CVE-2025-59985",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59985"
},
{
"name": "CVE-2025-11198",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11198"
},
{
"name": "CVE-2022-24806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24806"
},
{
"name": "CVE-2023-32233",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32233"
},
{
"name": "CVE-2024-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35789"
},
{
"name": "CVE-2024-26327",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-26327"
},
{
"name": "CVE-2015-3253",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
},
{
"name": "CVE-2025-59964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59964"
},
{
"name": "CVE-2025-59988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59988"
},
{
"name": "CVE-2024-21210",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21210"
},
{
"name": "CVE-2024-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"name": "CVE-2024-34397",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34397"
},
{
"name": "CVE-2023-45733",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45733"
},
{
"name": "CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"name": "CVE-2024-6655",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6655"
},
{
"name": "CVE-2024-41123",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41123"
},
{
"name": "CVE-2024-27049",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27049"
},
{
"name": "CVE-2025-59984",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59984"
},
{
"name": "CVE-2025-52961",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52961"
},
{
"name": "CVE-2023-51589",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51589"
},
{
"name": "CVE-2024-21217",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21217"
},
{
"name": "CVE-2024-28182",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28182"
},
{
"name": "CVE-2021-3903",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3903"
},
{
"name": "CVE-2024-35800",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35800"
},
{
"name": "CVE-2023-2124",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2124"
},
{
"name": "CVE-2023-51596",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51596"
},
{
"name": "CVE-2025-60010",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60010"
},
{
"name": "CVE-2023-51764",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51764"
},
{
"name": "CVE-2025-26594",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26594"
},
{
"name": "CVE-2024-6409",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6409"
},
{
"name": "CVE-2024-49761",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
},
{
"name": "CVE-2022-24808",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24808"
},
{
"name": "CVE-2025-59962",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59962"
},
{
"name": "CVE-2024-21208",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21208"
},
{
"name": "CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"name": "CVE-2024-40961",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40961"
}
],
"initial_release_date": "2025-10-09T00:00:00",
"last_revision_date": "2025-10-09T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0855",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-10-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Juniper Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper Networks",
"vendor_advisories": [
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103140",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Multiple-XSS-vulnerabilities-resolved-in-24-1R4-release"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103141",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R4-release"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103163",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-Multiple-OS-command-injection-vulnerabilities-fixed-CVE-2025-60006"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103168",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Device-allows-login-for-user-with-expired-password-CVE-2025-60010"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103171",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Reflected-client-side-HTTP-parameter-pollution-vulnerability-in-web-interface-CVE-2025-59977"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103167",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-When-a-user-with-the-name-ftp-or-anonymous-is-configured-unauthenticated-filesystem-access-is-allowed-CVE-2025-59980"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103156",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-ACX7024-ACX7024X-ACX7100-32C-ACX7100-48L-ACX7348-ACX7509-When-specific-valid-multicast-traffic-is-received-on-the-L3-interface-a-vulnerable-device-evo-pfemand-crashes-and-restarts-CVE-2025-59967"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103437",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Security-Director-Policy-Enforcer-An-unrestricted-API-allows-a-network-based-unauthenticated-attacker-to-deploy-malicious-vSRX-images-to-VMWare-NSX-Server-CVE-2025-11198"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103172",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Flooding-device-with-inbound-API-calls-leads-to-WebUI-and-CLI-management-access-DoS-CVE-2025-59975"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103157",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Juniper-Security-Director-Insufficient-authorization-for-sensitive-resources-in-web-interface-CVE-2025-59968"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103170",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Arbitrary-file-download-vulnerability-in-web-interface-CVE-2025-59976"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103139",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103151",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-sharding-enabled-change-in-indirect-next-hop-can-cause-RPD-crash-CVE-2025-59962"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103153",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX4700-When-forwarding-options-sampling-is-enabled-any-traffic-destined-to-the-RE-will-cause-the-forwarding-line-card-to-crash-and-restart-CVE-2025-59964"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103147",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-When-firewall-filter-rejects-traffic-these-packets-are-erroneously-sent-to-the-RE-CVE-2025-59958"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103144",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-except-PTX10003-An-unauthenticated-adjacent-attacker-sending-specific-valid-traffic-can-cause-a-memory-leak-in-cfmman-leading-to-FPC-crash-and-restart-CVE-2025-52961"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103143",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX-Series-and-MX-Series-Receipt-of-specific-SIP-packets-in-a-high-utilization-situation-causes-a-flowd-crash-CVE-2025-52960"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103146",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-EX4600-Series-and-QFX5000-Series-An-attacker-with-physical-access-can-open-a-persistent-backdoor-CVE-2025-59957"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103138",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4-by-upgrading-Log4j-Java-library-to-2-23-1-and-ElasticSearch-to-6-8-17"
},
{
"published_at": "2025-10-08",
"title": "Bulletin de s\u00e9curit\u00e9 Juniper Networks JSA103165",
"url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Specific-BGP-EVPN-update-message-causes-rpd-crash-CVE-2025-60004"
}
]
}
RHSA-2024:3139
Vulnerability from csaf_redhat - Published: 2024-05-22 09:35 - Updated: 2025-11-21 19:02Summary
Red Hat Security Advisory: squashfs-tools security update
Notes
Topic
An update for squashfs-tools is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.
Security Fix(es):
* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)
* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for squashfs-tools is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.\n\nSecurity Fix(es):\n\n* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)\n\n* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:3139",
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index"
},
{
"category": "external",
"summary": "1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3139.json"
}
],
"title": "Red Hat Security Advisory: squashfs-tools security update",
"tracking": {
"current_release_date": "2025-11-21T19:02:29+00:00",
"generator": {
"date": "2025-11-21T19:02:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2024:3139",
"initial_release_date": "2024-05-22T09:35:51+00:00",
"revision_history": [
{
"date": "2024-05-22T09:35:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-05-22T09:35:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T19:02:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.src",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.src",
"product_id": "squashfs-tools-0:4.3-21.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.src",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2021-08-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1998621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the \u0027../\u0027 string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: unvalidated filepaths allow writing outside of destination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "RHBZ#1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153"
}
],
"release_date": "2019-09-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T09:35:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: unvalidated filepaths allow writing outside of destination"
},
{
"cve": "CVE-2021-41072",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2021-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2004957"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: possible Directory Traversal via symbolic link",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "RHBZ#2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072"
}
],
"release_date": "2021-09-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T09:35:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: possible Directory Traversal via symbolic link"
}
]
}
RHSA-2024:2396
Vulnerability from csaf_redhat - Published: 2024-04-30 10:42 - Updated: 2025-11-21 19:00Summary
Red Hat Security Advisory: squashfs-tools security update
Notes
Topic
An update for squashfs-tools is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.
Security Fix(es):
* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)
* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for squashfs-tools is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.\n\nSecurity Fix(es):\n\n* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)\n\n* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:2396",
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index"
},
{
"category": "external",
"summary": "1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2396.json"
}
],
"title": "Red Hat Security Advisory: squashfs-tools security update",
"tracking": {
"current_release_date": "2025-11-21T19:00:10+00:00",
"generator": {
"date": "2025-11-21T19:00:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2024:2396",
"initial_release_date": "2024-04-30T10:42:19+00:00",
"revision_history": [
{
"date": "2024-04-30T10:42:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-04-30T10:42:19+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T19:00:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.src",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.src",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.src",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2021-08-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1998621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the \u0027../\u0027 string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: unvalidated filepaths allow writing outside of destination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "RHBZ#1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153"
}
],
"release_date": "2019-09-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-30T10:42:19+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: unvalidated filepaths allow writing outside of destination"
},
{
"cve": "CVE-2021-41072",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2021-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2004957"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: possible Directory Traversal via symbolic link",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "RHBZ#2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072"
}
],
"release_date": "2021-09-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-30T10:42:19+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: possible Directory Traversal via symbolic link"
}
]
}
RHSA-2024_3139
Vulnerability from csaf_redhat - Published: 2024-05-22 09:35 - Updated: 2024-11-23 01:03Summary
Red Hat Security Advisory: squashfs-tools security update
Notes
Topic
An update for squashfs-tools is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.
Security Fix(es):
* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)
* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for squashfs-tools is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.\n\nSecurity Fix(es):\n\n* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)\n\n* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:3139",
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index"
},
{
"category": "external",
"summary": "1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3139.json"
}
],
"title": "Red Hat Security Advisory: squashfs-tools security update",
"tracking": {
"current_release_date": "2024-11-23T01:03:29+00:00",
"generator": {
"date": "2024-11-23T01:03:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2024:3139",
"initial_release_date": "2024-05-22T09:35:51+00:00",
"revision_history": [
{
"date": "2024-05-22T09:35:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-05-22T09:35:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-23T01:03:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.src",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.src",
"product_id": "squashfs-tools-0:4.3-21.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.3-21.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.3-21.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product_id": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.3-21.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.src",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
"product_id": "BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
},
"product_reference": "squashfs-tools-debugsource-0:4.3-21.el8.x86_64",
"relates_to_product_reference": "BaseOS-8.10.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2021-08-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1998621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the \u0027../\u0027 string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: unvalidated filepaths allow writing outside of destination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "RHBZ#1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153"
}
],
"release_date": "2019-09-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T09:35:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: unvalidated filepaths allow writing outside of destination"
},
{
"cve": "CVE-2021-41072",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2021-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2004957"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: possible Directory Traversal via symbolic link",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "RHBZ#2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072"
}
],
"release_date": "2021-09-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T09:35:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.src",
"BaseOS-8.10.0.GA:squashfs-tools-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debuginfo-0:4.3-21.el8.x86_64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.aarch64",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.ppc64le",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.s390x",
"BaseOS-8.10.0.GA:squashfs-tools-debugsource-0:4.3-21.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: possible Directory Traversal via symbolic link"
}
]
}
RHSA-2024_2396
Vulnerability from csaf_redhat - Published: 2024-04-30 10:42 - Updated: 2024-11-23 01:03Summary
Red Hat Security Advisory: squashfs-tools security update
Notes
Topic
An update for squashfs-tools is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.
Security Fix(es):
* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)
* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for squashfs-tools is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.\n\nSecurity Fix(es):\n\n* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)\n\n* squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:2396",
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index"
},
{
"category": "external",
"summary": "1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2396.json"
}
],
"title": "Red Hat Security Advisory: squashfs-tools security update",
"tracking": {
"current_release_date": "2024-11-23T01:03:19+00:00",
"generator": {
"date": "2024-11-23T01:03:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2024:2396",
"initial_release_date": "2024-04-30T10:42:19+00:00",
"revision_history": [
{
"date": "2024-04-30T10:42:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-04-30T10:42:19+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-23T01:03:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.src",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.src",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools@4.4-10.git1.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debugsource@4.4-10.git1.el9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product_id": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/squashfs-tools-debuginfo@4.4-10.git1.el9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.src",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
},
"product_reference": "squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64",
"relates_to_product_reference": "BaseOS-9.4.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2021-08-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1998621"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the \u0027../\u0027 string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: unvalidated filepaths allow writing outside of destination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "RHBZ#1998621",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1998621"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-40153",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153"
}
],
"release_date": "2019-09-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-30T10:42:19+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: unvalidated filepaths allow writing outside of destination"
},
{
"cve": "CVE-2021-41072",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2021-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2004957"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "squashfs-tools: possible Directory Traversal via symbolic link",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "RHBZ#2004957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-41072",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41072"
}
],
"release_date": "2021-09-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-04-30T10:42:19+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.src",
"BaseOS-9.4.0.GA:squashfs-tools-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debuginfo-0:4.4-10.git1.el9.x86_64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.aarch64",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.ppc64le",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.s390x",
"BaseOS-9.4.0.GA:squashfs-tools-debugsource-0:4.4-10.git1.el9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "squashfs-tools: possible Directory Traversal via symbolic link"
}
]
}
OPENSUSE-SU-2024:13035-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
squashfs-4.6.1-2.1 on GA media
Notes
Title of the patch
squashfs-4.6.1-2.1 on GA media
Description of the patch
These are all security issues fixed in the squashfs-4.6.1-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-13035
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "squashfs-4.6.1-2.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the squashfs-4.6.1-2.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13035",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13035-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-40153 page",
"url": "https://www.suse.com/security/cve/CVE-2021-40153/"
}
],
"title": "squashfs-4.6.1-2.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13035-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-2.1.aarch64",
"product": {
"name": "squashfs-4.6.1-2.1.aarch64",
"product_id": "squashfs-4.6.1-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-2.1.ppc64le",
"product": {
"name": "squashfs-4.6.1-2.1.ppc64le",
"product_id": "squashfs-4.6.1-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-2.1.s390x",
"product": {
"name": "squashfs-4.6.1-2.1.s390x",
"product_id": "squashfs-4.6.1-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-2.1.x86_64",
"product": {
"name": "squashfs-4.6.1-2.1.x86_64",
"product_id": "squashfs-4.6.1-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:squashfs-4.6.1-2.1.aarch64"
},
"product_reference": "squashfs-4.6.1-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:squashfs-4.6.1-2.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:squashfs-4.6.1-2.1.s390x"
},
"product_reference": "squashfs-4.6.1-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:squashfs-4.6.1-2.1.x86_64"
},
"product_reference": "squashfs-4.6.1-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-40153"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.aarch64",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.ppc64le",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.s390x",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-40153",
"url": "https://www.suse.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-40153",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.aarch64",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.ppc64le",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.s390x",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.aarch64",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.ppc64le",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.s390x",
"openSUSE Tumbleweed:squashfs-4.6.1-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-40153"
}
]
}
GSD-2021-40153
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-40153",
"description": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"id": "GSD-2021-40153",
"references": [
"https://www.suse.com/security/cve/CVE-2021-40153.html",
"https://www.debian.org/security/2021/dsa-4967",
"https://ubuntu.com/security/CVE-2021-40153",
"https://advisories.mageia.org/CVE-2021-40153.html",
"https://security.archlinux.org/CVE-2021-40153"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-40153"
],
"details": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"id": "GSD-2021-40153",
"modified": "2023-12-13T01:23:25.587033Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-40153",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646",
"refsource": "MISC",
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"name": "https://github.com/plougher/squashfs-tools/issues/72",
"refsource": "MISC",
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"name": "FEDORA-2021-cdbd827c1e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2752-1] squashfs-tools security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"name": "DSA-4967",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4967"
},
{
"name": "FEDORA-2021-9fb6da134f",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"name": "GLSA-202305-29",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202305-29"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:squashfs-tools_project:squashfs-tools:4.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-40153"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"name": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"name": "https://github.com/plougher/squashfs-tools/issues/72",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"name": "FEDORA-2021-cdbd827c1e",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"name": "[debian-lts-announce] 20210831 [SECURITY] [DLA 2752-1] squashfs-tools security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"name": "DSA-4967",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4967"
},
{
"name": "FEDORA-2021-9fb6da134f",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"name": "GLSA-202305-29",
"refsource": "GENTOO",
"tags": [],
"url": "https://security.gentoo.org/glsa/202305-29"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
},
"lastModifiedDate": "2023-05-30T06:15Z",
"publishedDate": "2021-08-27T15:15Z"
}
}
}
FKIE_CVE-2021-40153
Vulnerability from fkie_nvd - Published: 2021-08-27 15:15 - Updated: 2024-11-21 06:23
Severity ?
Summary
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790 | Third Party Advisory | |
| cve@mitre.org | https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646 | Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/plougher/squashfs-tools/issues/72 | Exploit, Third Party Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/ | ||
| cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/ | ||
| cve@mitre.org | https://security.gentoo.org/glsa/202305-29 | ||
| cve@mitre.org | https://www.debian.org/security/2021/dsa-4967 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/plougher/squashfs-tools/issues/72 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/202305-29 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2021/dsa-4967 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| squashfs-tools_project | squashfs-tools | 4.5 | |
| fedoraproject | fedora | 34 | |
| debian | debian_linux | 9.0 | |
| debian | debian_linux | 10.0 | |
| redhat | enterprise_linux | 7.0 | |
| redhat | enterprise_linux | 8.0 | |
| fedoraproject | fedora | 33 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:squashfs-tools_project:squashfs-tools:4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "259A52A7-B40A-45B5-B5F5-CE79A4DE4266",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination."
},
{
"lang": "es",
"value": "La funci\u00f3n squashfs_opendir en el archivo unsquash-1.c en Squashfs-Tools versi\u00f3n 4.5, almacena el nombre del archivo en la entrada del directorio; esto es entonces usado por unsquashfs para crear el nuevo archivo durante el desensamblaje. El nombre de archivo no se comprueba para saltar fuera del directorio de destino, y por lo tanto permite escribir en lugares fuera del destino."
}
],
"id": "CVE-2021-40153",
"lastModified": "2024-11-21T06:23:40.510",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-27T15:15:09.657",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202305-29"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4967"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202305-29"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4967"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
WID-SEC-W-2024-0995
Vulnerability from csaf_certbund - Published: 2024-04-29 22:00 - Updated: 2025-11-17 23:00Summary
Red Hat Enterprise Linux: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-0995 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0995.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-0995 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0995"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2137"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2147"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2295"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2337"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2366"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2396"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2512"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2199"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2204"
},
{
"category": "external",
"summary": "Red Hat Security Advisory vom 2024-04-29",
"url": "https://access.redhat.com/errata/RHSA-2024:2438"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3105 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3105"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3120 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3120"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3044 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3044"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3139 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3139"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3163 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3163"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:3008 vom 2024-05-22",
"url": "https://access.redhat.com/errata/RHSA-2024:3008"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-3044 vom 2024-05-28",
"url": "https://linux.oracle.com/errata/ELSA-2024-3044.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:0136-2 vom 2024-07-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-July/018909.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:2375-1 vom 2024-07-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-July/018915.html"
},
{
"category": "external",
"summary": "Gentoo Linux Security Advisory GLSA-202409-06 vom 2024-09-22",
"url": "https://security.gentoo.org/glsa/202409-06"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2024:10965 vom 2024-12-11",
"url": "https://access.redhat.com/errata/RHSA-2024:10965"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2024-11250 vom 2024-12-19",
"url": "https://linux.oracle.com/errata/ELSA-2024-11250.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7266-1 vom 2025-02-13",
"url": "https://ubuntu.com/security/notices/USN-7266-1"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13098 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13098"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13100 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13100"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13101 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13101"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13103 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13103"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13104 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13104"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:13102 vom 2025-08-06",
"url": "https://access.redhat.com/errata/RHSA-2025:13102"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:14553 vom 2025-08-26",
"url": "https://access.redhat.com/errata/RHSA-2025:14553"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-14553 vom 2025-08-26",
"url": "https://linux.oracle.com/errata/ELSA-2025-14553.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:15874 vom 2025-09-16",
"url": "https://access.redhat.com/errata/RHSA-2025:15874"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-15874 vom 2025-09-17",
"url": "https://linux.oracle.com/errata/ELSA-2025-15874.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:15874 vom 2025-10-10",
"url": "https://errata.build.resf.org/RLSA-2025:15874"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7870-1 vom 2025-11-18",
"url": "https://ubuntu.com/security/notices/USN-7870-1"
}
],
"source_lang": "en-US",
"title": "Red Hat Enterprise Linux: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-11-17T23:00:00.000+00:00",
"generator": {
"date": "2025-11-18T08:17:28.561+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2024-0995",
"initial_release_date": "2024-04-29T22:00:00.000+00:00",
"revision_history": [
{
"date": "2024-04-29T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2024-05-21T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2024-05-28T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2024-07-09T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-09-22T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Gentoo aufgenommen"
},
{
"date": "2024-12-11T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2024-12-19T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-02-12T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2025-08-05T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-08-25T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-08-26T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-09-15T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-09-16T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-10-09T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2025-11-17T23:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Ubuntu aufgenommen"
}
],
"status": "final",
"version": "15"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"category": "product_version",
"name": "9",
"product": {
"name": "Red Hat Enterprise Linux 9",
"product_id": "T034465",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9"
}
}
},
{
"category": "product_version",
"name": "8",
"product": {
"name": "Red Hat Enterprise Linux 8",
"product_id": "T034466",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:8"
}
}
},
{
"category": "product_version",
"name": "7",
"product": {
"name": "Red Hat Enterprise Linux 7",
"product_id": "T034467",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7"
}
}
}
],
"category": "product_name",
"name": "Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-29390",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2021-29390"
},
{
"cve": "CVE-2022-48554",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2022-48554"
},
{
"cve": "CVE-2023-1729",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2023-1729"
},
{
"cve": "CVE-2023-49083",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2023-49083"
},
{
"cve": "CVE-2023-5215",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2023-5215"
},
{
"cve": "CVE-2023-5871",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2023-5871"
},
{
"cve": "CVE-2024-1481",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2024-1481"
},
{
"cve": "CVE-2024-22365",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2024-22365"
},
{
"cve": "CVE-2024-24258",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2024-24258"
},
{
"cve": "CVE-2024-24259",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2024-24259"
},
{
"cve": "CVE-2021-40153",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2021-40153"
},
{
"cve": "CVE-2021-41072",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2021-41072"
},
{
"cve": "CVE-2023-41915",
"product_status": {
"known_affected": [
"T034467",
"T002207",
"67646",
"T000126",
"T012167",
"T004914",
"T034466",
"T032255",
"T034465"
]
},
"release_date": "2024-04-29T22:00:00.000+00:00",
"title": "CVE-2023-41915"
}
]
}
SUSE-SU-2023:4424-1
Vulnerability from csaf_suse - Published: 2023-11-13 12:12 - Updated: 2023-11-13 12:12Summary
Security update for squashfs
Notes
Title of the patch
Security update for squashfs
Description of the patch
This update for squashfs fixes the following issues:
- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)
- CVE-2021-40153: Fixed an issue where an attacker might have been
able to write a file outside of destination (bsc#1189936)
- CVE-2021-41072: Fixed an issue where an attacker might have been
able to write a file outside the destination directory via a
symlink (bsc#1190531).
Patchnames
SUSE-2023-4424,SUSE-SLE-SERVER-12-SP5-2023-4424
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for squashfs",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been\n able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n able to write a file outside the destination directory via a\n symlink (bsc#1190531).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2023-4424,SUSE-SLE-SERVER-12-SP5-2023-4424",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4424-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2023:4424-1",
"url": "https://www.suse.com/support/update/announcement/2023/suse-su-20234424-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2023:4424-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2023-November/017023.html"
},
{
"category": "self",
"summary": "SUSE Bug 1133284",
"url": "https://bugzilla.suse.com/1133284"
},
{
"category": "self",
"summary": "SUSE Bug 1160294",
"url": "https://bugzilla.suse.com/1160294"
},
{
"category": "self",
"summary": "SUSE Bug 1189936",
"url": "https://bugzilla.suse.com/1189936"
},
{
"category": "self",
"summary": "SUSE Bug 1190531",
"url": "https://bugzilla.suse.com/1190531"
},
{
"category": "self",
"summary": "SUSE Bug 935380",
"url": "https://bugzilla.suse.com/935380"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4645 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4645/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4646 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4646/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-40153 page",
"url": "https://www.suse.com/security/cve/CVE-2021-40153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41072 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41072/"
}
],
"title": "Security update for squashfs",
"tracking": {
"current_release_date": "2023-11-13T12:12:08Z",
"generator": {
"date": "2023-11-13T12:12:08Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2023:4424-1",
"initial_release_date": "2023-11-13T12:12:08Z",
"revision_history": [
{
"date": "2023-11-13T12:12:08Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-8.3.2.aarch64",
"product": {
"name": "squashfs-4.6.1-8.3.2.aarch64",
"product_id": "squashfs-4.6.1-8.3.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-8.3.2.i586",
"product": {
"name": "squashfs-4.6.1-8.3.2.i586",
"product_id": "squashfs-4.6.1-8.3.2.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-8.3.2.ppc64le",
"product": {
"name": "squashfs-4.6.1-8.3.2.ppc64le",
"product_id": "squashfs-4.6.1-8.3.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-8.3.2.s390x",
"product": {
"name": "squashfs-4.6.1-8.3.2.s390x",
"product_id": "squashfs-4.6.1-8.3.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-8.3.2.x86_64",
"product": {
"name": "squashfs-4.6.1-8.3.2.x86_64",
"product_id": "squashfs-4.6.1-8.3.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64"
},
"product_reference": "squashfs-4.6.1-8.3.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le"
},
"product_reference": "squashfs-4.6.1-8.3.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.s390x as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x"
},
"product_reference": "squashfs-4.6.1-8.3.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
},
"product_reference": "squashfs-4.6.1-8.3.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64"
},
"product_reference": "squashfs-4.6.1-8.3.2.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le"
},
"product_reference": "squashfs-4.6.1-8.3.2.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x"
},
"product_reference": "squashfs-4.6.1-8.3.2.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-8.3.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
},
"product_reference": "squashfs-4.6.1-8.3.2.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-4645",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4645"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4645",
"url": "https://www.suse.com/security/cve/CVE-2015-4645"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4645",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-13T12:12:08Z",
"details": "moderate"
}
],
"title": "CVE-2015-4645"
},
{
"cve": "CVE-2015-4646",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4646"
}
],
"notes": [
{
"category": "general",
"text": "(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4646",
"url": "https://www.suse.com/security/cve/CVE-2015-4646"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4646",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-13T12:12:08Z",
"details": "moderate"
}
],
"title": "CVE-2015-4646"
},
{
"cve": "CVE-2021-40153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-40153"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-40153",
"url": "https://www.suse.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-40153",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-13T12:12:08Z",
"details": "moderate"
}
],
"title": "CVE-2021-40153"
},
{
"cve": "CVE-2021-41072",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41072"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41072",
"url": "https://www.suse.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-41072",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server 12 SP5:squashfs-4.6.1-8.3.2.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs-4.6.1-8.3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-13T12:12:08Z",
"details": "moderate"
}
],
"title": "CVE-2021-41072"
}
]
}
SUSE-SU-2023:4591-1
Vulnerability from csaf_suse - Published: 2023-11-27 13:32 - Updated: 2023-11-27 13:32Summary
Security update for squashfs
Notes
Title of the patch
Security update for squashfs
Description of the patch
This update for squashfs fixes the following issues:
- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)
- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)
- CVE-2021-41072: Fixed an issue where an attacker might have been
able to write a file outside the destination directory via a
symlink (bsc#1190531).
update to 4.6.1:
* Race condition which can cause corruption of the 'fragment
table' fixed. This is a regression introduced in August 2022,
and it has been seen when tailend packing is used (-tailends option).
* Fix build failure when the tools are being built without
extended attribute (XATTRs) support.
* Fix XATTR error message when an unrecognised prefix is
found
* Fix incorrect free of pointer when an unrecognised XATTR
prefix is found.
* Major improvements in extended attribute handling,
pseudo file handling, and miscellaneous new options and
improvements
* Extended attribute handling improved in Mksquashfs and
Sqfstar
* New Pseudo file xattr definition to add extended
attributes to files.
* New xattrs-add Action to add extended attributes to files
* Extended attribute handling improved in Unsquashfs
* Other major improvements
* Unsquashfs can now output Pseudo files to standard out.
* Mksquashfs can now input Pseudo files from standard in.
* Squashfs filesystems can now be converted (different
block size compression etc) without unpacking to an
intermediate filesystem or mounting, by piping the output of
Unsquashfs to Mksquashfs.
* Pseudo files are now supported by Sqfstar.
* 'Non-anchored' excludes are now supported by Unsquashfs.
update to 4.5.1 (bsc#1190531, CVE-2021-41072):
* This release adds Manpages for Mksquashfs(1), Unsquashfs(1),
Sqfstar(1) and Sqfscat(1).
* The -help text output from the utilities has been improved
and extended as well (but the Manpages are now more
comprehensive).
* CVE-2021-41072 which is a writing outside of destination
exploit, has been fixed.
* The number of hard-links in the filesystem is now also
displayed by Mksquashfs in the output summary.
* The number of hard-links written by Unsquashfs is now
also displayed in the output summary.
* Unsquashfs will now write to a pre-existing destination
directory, rather than aborting.
* Unsquashfs now allows '.' to used as the destination, to
extract to the current directory.
* The Unsquashfs progress bar now tracks empty files and
hardlinks, in addition to data blocks.
* -no-hardlinks option has been implemented for Sqfstar.
* More sanity checking for 'corrupted' filesystems, including
checks for multiply linked directories and directory loops.
* Options that may cause filesystems to be unmountable have
been moved into a new 'experts' category in the Mksquashfs
help text (and Manpage).
* Maximum cpiostyle filename limited to PATH_MAX. This
prevents attempts to overflow the stack, or cause system
calls to fail with a too long pathname.
* Don't always use 'max open file limit' when calculating
length of queues, as a very large file limit can cause
Unsquashfs to abort. Instead use the smaller of max open
file limit and cache size.
* Fix Mksquashfs silently ignoring Pseudo file definitions
when appending.
* Don't abort if no XATTR support has been built in, and
there's XATTRs in the filesystem. This is a regression
introduced in 2019 in Version 4.4.
* Fix duplicate check when the last file block is sparse.
update to 4.5:
* Mksquashfs now supports 'Actions'.
* New sqfstar command which will create a Squashfs image from a tar archive.
* Tar style handling of source pathnames in Mksquashfs.
* Cpio style handling of source pathnames in Mksquashfs.
* New option to throttle the amount of CPU and I/O.
* Mksquashfs now allows no source directory to be specified.
* New Pseudo file 'R' definition which allows a Regular file
o be created with data stored within the Pseudo file.
* Symbolic links are now followed in extract files
* Unsquashfs now supports 'exclude' files.
* Max depth traversal option added.
* Unsquashfs can now output a 'Pseudo file' representing the
input Squashfs filesystem.
* New -one-file-system option in Mksquashfs.
* New -no-hardlinks option in Mksquashfs.
* Exit code in Unsquashfs changed to distinguish between
non-fatal errors (exit 2), and fatal errors (exit 1).
* Xattr id count added in Unsquashfs '-stat' output.
* Unsquashfs 'write outside directory' exploit fixed.
* Error handling in Unsquashfs writer thread fixed.
* Fix failure to truncate destination if appending aborted.
* Prevent Mksquashfs reading the destination file.
Patchnames
SUSE-2023-4591,SUSE-SLE-Micro-5.3-2023-4591,SUSE-SLE-Micro-5.4-2023-4591,SUSE-SLE-Micro-5.5-2023-4591,SUSE-SLE-Module-Basesystem-15-SP4-2023-4591,SUSE-SLE-Module-Basesystem-15-SP5-2023-4591,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4591,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4591,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4591,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4591,SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4591,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4591,SUSE-SUSE-MicroOS-5.1-2023-4591,SUSE-SUSE-MicroOS-5.2-2023-4591,SUSE-Storage-7.1-2023-4591,openSUSE-Leap-Micro-5.3-2023-4591,openSUSE-Leap-Micro-5.4-2023-4591,openSUSE-SLE-15.4-2023-4591,openSUSE-SLE-15.5-2023-4591
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for squashfs",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n able to write a file outside the destination directory via a\n symlink (bsc#1190531).\n\nupdate to 4.6.1:\n\n * Race condition which can cause corruption of the \u0027fragment\n table\u0027 fixed. This is a regression introduced in August 2022,\n and it has been seen when tailend packing is used (-tailends option).\n * Fix build failure when the tools are being built without\n extended attribute (XATTRs) support.\n * Fix XATTR error message when an unrecognised prefix is\n found\n * Fix incorrect free of pointer when an unrecognised XATTR\n prefix is found.\n * Major improvements in extended attribute handling,\n pseudo file handling, and miscellaneous new options and\n improvements\n * Extended attribute handling improved in Mksquashfs and\n Sqfstar\n * New Pseudo file xattr definition to add extended\n attributes to files.\n * New xattrs-add Action to add extended attributes to files\n * Extended attribute handling improved in Unsquashfs\n * Other major improvements\n * Unsquashfs can now output Pseudo files to standard out.\n * Mksquashfs can now input Pseudo files from standard in.\n * Squashfs filesystems can now be converted (different\n block size compression etc) without unpacking to an\n intermediate filesystem or mounting, by piping the output of\n Unsquashfs to Mksquashfs.\n * Pseudo files are now supported by Sqfstar.\n * \u0027Non-anchored\u0027 excludes are now supported by Unsquashfs.\n\nupdate to 4.5.1 (bsc#1190531, CVE-2021-41072):\n\n * This release adds Manpages for Mksquashfs(1), Unsquashfs(1),\n Sqfstar(1) and Sqfscat(1).\n * The -help text output from the utilities has been improved\n and extended as well (but the Manpages are now more\n comprehensive).\n * CVE-2021-41072 which is a writing outside of destination\n exploit, has been fixed.\n * The number of hard-links in the filesystem is now also\n displayed by Mksquashfs in the output summary.\n * The number of hard-links written by Unsquashfs is now\n also displayed in the output summary.\n * Unsquashfs will now write to a pre-existing destination\n directory, rather than aborting.\n * Unsquashfs now allows \u0027.\u0027 to used as the destination, to\n extract to the current directory.\n * The Unsquashfs progress bar now tracks empty files and\n hardlinks, in addition to data blocks.\n * -no-hardlinks option has been implemented for Sqfstar.\n * More sanity checking for \u0027corrupted\u0027 filesystems, including\n checks for multiply linked directories and directory loops.\n * Options that may cause filesystems to be unmountable have\n been moved into a new \u0027experts\u0027 category in the Mksquashfs\n help text (and Manpage).\n * Maximum cpiostyle filename limited to PATH_MAX. This\n prevents attempts to overflow the stack, or cause system\n calls to fail with a too long pathname.\n * Don\u0027t always use \u0027max open file limit\u0027 when calculating\n length of queues, as a very large file limit can cause\n Unsquashfs to abort. Instead use the smaller of max open\n file limit and cache size.\n * Fix Mksquashfs silently ignoring Pseudo file definitions\n when appending.\n * Don\u0027t abort if no XATTR support has been built in, and\n there\u0027s XATTRs in the filesystem. This is a regression\n introduced in 2019 in Version 4.4.\n * Fix duplicate check when the last file block is sparse.\n\nupdate to 4.5:\n\n * Mksquashfs now supports \u0027Actions\u0027.\n * New sqfstar command which will create a Squashfs image from a tar archive.\n * Tar style handling of source pathnames in Mksquashfs.\n * Cpio style handling of source pathnames in Mksquashfs.\n * New option to throttle the amount of CPU and I/O.\n * Mksquashfs now allows no source directory to be specified.\n * New Pseudo file \u0027R\u0027 definition which allows a Regular file\n o be created with data stored within the Pseudo file.\n * Symbolic links are now followed in extract files\n * Unsquashfs now supports \u0027exclude\u0027 files.\n * Max depth traversal option added.\n * Unsquashfs can now output a \u0027Pseudo file\u0027 representing the\n input Squashfs filesystem.\n * New -one-file-system option in Mksquashfs.\n * New -no-hardlinks option in Mksquashfs.\n * Exit code in Unsquashfs changed to distinguish between\n non-fatal errors (exit 2), and fatal errors (exit 1).\n * Xattr id count added in Unsquashfs \u0027-stat\u0027 output.\n * Unsquashfs \u0027write outside directory\u0027 exploit fixed.\n * Error handling in Unsquashfs writer thread fixed.\n * Fix failure to truncate destination if appending aborted.\n * Prevent Mksquashfs reading the destination file. \n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2023-4591,SUSE-SLE-Micro-5.3-2023-4591,SUSE-SLE-Micro-5.4-2023-4591,SUSE-SLE-Micro-5.5-2023-4591,SUSE-SLE-Module-Basesystem-15-SP4-2023-4591,SUSE-SLE-Module-Basesystem-15-SP5-2023-4591,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4591,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4591,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4591,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4591,SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4591,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4591,SUSE-SUSE-MicroOS-5.1-2023-4591,SUSE-SUSE-MicroOS-5.2-2023-4591,SUSE-Storage-7.1-2023-4591,openSUSE-Leap-Micro-5.3-2023-4591,openSUSE-Leap-Micro-5.4-2023-4591,openSUSE-SLE-15.4-2023-4591,openSUSE-SLE-15.5-2023-4591",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4591-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2023:4591-1",
"url": "https://www.suse.com/support/update/announcement/2023/suse-su-20234591-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2023:4591-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2023-November/017236.html"
},
{
"category": "self",
"summary": "SUSE Bug 1189936",
"url": "https://bugzilla.suse.com/1189936"
},
{
"category": "self",
"summary": "SUSE Bug 1190531",
"url": "https://bugzilla.suse.com/1190531"
},
{
"category": "self",
"summary": "SUSE Bug 935380",
"url": "https://bugzilla.suse.com/935380"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4645 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4645/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4646 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4646/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-40153 page",
"url": "https://www.suse.com/security/cve/CVE-2021-40153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41072 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41072/"
}
],
"title": "Security update for squashfs",
"tracking": {
"current_release_date": "2023-11-27T13:32:32Z",
"generator": {
"date": "2023-11-27T13:32:32Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2023:4591-1",
"initial_release_date": "2023-11-27T13:32:32Z",
"revision_history": [
{
"date": "2023-11-27T13:32:32Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.aarch64",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64",
"product_id": "squashfs-4.6.1-150300.3.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.i586",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.i586",
"product_id": "squashfs-4.6.1-150300.3.3.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"product_id": "squashfs-4.6.1-150300.3.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.s390x",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x",
"product_id": "squashfs-4.6.1-150300.3.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.x86_64",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64",
"product_id": "squashfs-4.6.1-150300.3.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.3",
"product": {
"name": "SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Proxy 4.2",
"product": {
"name": "SUSE Manager Proxy 4.2",
"product_id": "SUSE Manager Proxy 4.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-proxy:4.2"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Server 4.2",
"product": {
"name": "SUSE Manager Server 4.2",
"product_id": "SUSE Manager Server 4.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-server:4.2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.1",
"product": {
"name": "SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 7.1",
"product": {
"name": "SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:7.1"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap Micro 5.3",
"product": {
"name": "openSUSE Leap Micro 5.3",
"product_id": "openSUSE Leap Micro 5.3",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap-micro:5.3"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap Micro 5.4",
"product": {
"name": "openSUSE Leap Micro 5.4",
"product_id": "openSUSE Leap Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap-micro:5.4"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.4",
"product": {
"name": "openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.4"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.5",
"product": {
"name": "openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Manager Proxy 4.2",
"product_id": "SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Manager Proxy 4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Manager Server 4.2",
"product_id": "SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Server 4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Manager Server 4.2",
"product_id": "SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Manager Server 4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Manager Server 4.2",
"product_id": "SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Manager Server 4.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 7.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of SUSE Enterprise Storage 7.1",
"product_id": "SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 7.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of openSUSE Leap Micro 5.3",
"product_id": "openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of openSUSE Leap Micro 5.3",
"product_id": "openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of openSUSE Leap Micro 5.4",
"product_id": "openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of openSUSE Leap Micro 5.4",
"product_id": "openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of openSUSE Leap Micro 5.4",
"product_id": "openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of openSUSE Leap 15.4",
"product_id": "openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.aarch64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.s390x as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.x86_64 as component of openSUSE Leap 15.5",
"product_id": "openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-4645",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4645"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4645",
"url": "https://www.suse.com/security/cve/CVE-2015-4645"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4645",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-27T13:32:32Z",
"details": "moderate"
}
],
"title": "CVE-2015-4645"
},
{
"cve": "CVE-2015-4646",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4646"
}
],
"notes": [
{
"category": "general",
"text": "(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4646",
"url": "https://www.suse.com/security/cve/CVE-2015-4646"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4646",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-27T13:32:32Z",
"details": "moderate"
}
],
"title": "CVE-2015-4646"
},
{
"cve": "CVE-2021-40153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-40153"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-40153",
"url": "https://www.suse.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-40153",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-27T13:32:32Z",
"details": "moderate"
}
],
"title": "CVE-2021-40153"
},
{
"cve": "CVE-2021-41072",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41072"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41072",
"url": "https://www.suse.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-41072",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Enterprise Storage 7.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.1:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.aarch64",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Linux Enterprise Server 15 SP3-LTSS:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Proxy 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.ppc64le",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.s390x",
"SUSE Manager Server 4.2:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.4:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.ppc64le",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap 15.5:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.3:squashfs-4.6.1-150300.3.3.1.x86_64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.aarch64",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.s390x",
"openSUSE Leap Micro 5.4:squashfs-4.6.1-150300.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-27T13:32:32Z",
"details": "moderate"
}
],
"title": "CVE-2021-41072"
}
]
}
SUSE-SU-2024:2463-1
Vulnerability from csaf_suse - Published: 2024-07-12 13:55 - Updated: 2024-07-12 13:55Summary
Security update for squashfs
Notes
Title of the patch
Security update for squashfs
Description of the patch
This update for squashfs fixes the following issues:
- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)
- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)
- CVE-2021-41072: Fixed an issue where an attacker might have been
able to write a file outside the destination directory via a
symlink (bsc#1190531).
update to 4.6.1:
* Race condition which can cause corruption of the 'fragment
table' fixed. This is a regression introduced in August 2022,
and it has been seen when tailend packing is used (-tailends option).
* Fix build failure when the tools are being built without
extended attribute (XATTRs) support.
* Fix XATTR error message when an unrecognised prefix is
found
* Fix incorrect free of pointer when an unrecognised XATTR
prefix is found.
* Major improvements in extended attribute handling,
pseudo file handling, and miscellaneous new options and
improvements
* Extended attribute handling improved in Mksquashfs and
Sqfstar
* New Pseudo file xattr definition to add extended
attributes to files.
* New xattrs-add Action to add extended attributes to files
* Extended attribute handling improved in Unsquashfs
* Other major improvements
* Unsquashfs can now output Pseudo files to standard out.
* Mksquashfs can now input Pseudo files from standard in.
* Squashfs filesystems can now be converted (different
block size compression etc) without unpacking to an
intermediate filesystem or mounting, by piping the output of
Unsquashfs to Mksquashfs.
* Pseudo files are now supported by Sqfstar.
* 'Non-anchored' excludes are now supported by Unsquashfs.
update to 4.5.1 (bsc#1190531, CVE-2021-41072):
* This release adds Manpages for Mksquashfs(1), Unsquashfs(1),
Sqfstar(1) and Sqfscat(1).
* The -help text output from the utilities has been improved
and extended as well (but the Manpages are now more
comprehensive).
* CVE-2021-41072 which is a writing outside of destination
exploit, has been fixed.
* The number of hard-links in the filesystem is now also
displayed by Mksquashfs in the output summary.
* The number of hard-links written by Unsquashfs is now
also displayed in the output summary.
* Unsquashfs will now write to a pre-existing destination
directory, rather than aborting.
* Unsquashfs now allows '.' to used as the destination, to
extract to the current directory.
* The Unsquashfs progress bar now tracks empty files and
hardlinks, in addition to data blocks.
* -no-hardlinks option has been implemented for Sqfstar.
* More sanity checking for 'corrupted' filesystems, including
checks for multiply linked directories and directory loops.
* Options that may cause filesystems to be unmountable have
been moved into a new 'experts' category in the Mksquashfs
help text (and Manpage).
* Maximum cpiostyle filename limited to PATH_MAX. This
prevents attempts to overflow the stack, or cause system
calls to fail with a too long pathname.
* Don't always use 'max open file limit' when calculating
length of queues, as a very large file limit can cause
Unsquashfs to abort. Instead use the smaller of max open
file limit and cache size.
* Fix Mksquashfs silently ignoring Pseudo file definitions
when appending.
* Don't abort if no XATTR support has been built in, and
there's XATTRs in the filesystem. This is a regression
introduced in 2019 in Version 4.4.
* Fix duplicate check when the last file block is sparse.
update to 4.5:
* Mksquashfs now supports 'Actions'.
* New sqfstar command which will create a Squashfs image from a tar archive.
* Tar style handling of source pathnames in Mksquashfs.
* Cpio style handling of source pathnames in Mksquashfs.
* New option to throttle the amount of CPU and I/O.
* Mksquashfs now allows no source directory to be specified.
* New Pseudo file 'R' definition which allows a Regular file
o be created with data stored within the Pseudo file.
* Symbolic links are now followed in extract files
* Unsquashfs now supports 'exclude' files.
* Max depth traversal option added.
* Unsquashfs can now output a 'Pseudo file' representing the
input Squashfs filesystem.
* New -one-file-system option in Mksquashfs.
* New -no-hardlinks option in Mksquashfs.
* Exit code in Unsquashfs changed to distinguish between
non-fatal errors (exit 2), and fatal errors (exit 1).
* Xattr id count added in Unsquashfs '-stat' output.
* Unsquashfs 'write outside directory' exploit fixed.
* Error handling in Unsquashfs writer thread fixed.
* Fix failure to truncate destination if appending aborted.
* Prevent Mksquashfs reading the destination file.
Patchnames
SUSE-2024-2463,SUSE-SLE-Micro-5.5-2024-2463
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for squashfs",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n able to write a file outside the destination directory via a\n symlink (bsc#1190531).\n\nupdate to 4.6.1:\n\n * Race condition which can cause corruption of the \u0027fragment\n table\u0027 fixed. This is a regression introduced in August 2022,\n and it has been seen when tailend packing is used (-tailends option).\n * Fix build failure when the tools are being built without\n extended attribute (XATTRs) support.\n * Fix XATTR error message when an unrecognised prefix is\n found\n * Fix incorrect free of pointer when an unrecognised XATTR\n prefix is found.\n * Major improvements in extended attribute handling,\n pseudo file handling, and miscellaneous new options and\n improvements\n * Extended attribute handling improved in Mksquashfs and\n Sqfstar\n * New Pseudo file xattr definition to add extended\n attributes to files.\n * New xattrs-add Action to add extended attributes to files\n * Extended attribute handling improved in Unsquashfs\n * Other major improvements\n * Unsquashfs can now output Pseudo files to standard out.\n * Mksquashfs can now input Pseudo files from standard in.\n * Squashfs filesystems can now be converted (different\n block size compression etc) without unpacking to an\n intermediate filesystem or mounting, by piping the output of\n Unsquashfs to Mksquashfs.\n * Pseudo files are now supported by Sqfstar.\n * \u0027Non-anchored\u0027 excludes are now supported by Unsquashfs.\n\nupdate to 4.5.1 (bsc#1190531, CVE-2021-41072):\n\n * This release adds Manpages for Mksquashfs(1), Unsquashfs(1),\n Sqfstar(1) and Sqfscat(1).\n * The -help text output from the utilities has been improved\n and extended as well (but the Manpages are now more\n comprehensive).\n * CVE-2021-41072 which is a writing outside of destination\n exploit, has been fixed.\n * The number of hard-links in the filesystem is now also\n displayed by Mksquashfs in the output summary.\n * The number of hard-links written by Unsquashfs is now\n also displayed in the output summary.\n * Unsquashfs will now write to a pre-existing destination\n directory, rather than aborting.\n * Unsquashfs now allows \u0027.\u0027 to used as the destination, to\n extract to the current directory.\n * The Unsquashfs progress bar now tracks empty files and\n hardlinks, in addition to data blocks.\n * -no-hardlinks option has been implemented for Sqfstar.\n * More sanity checking for \u0027corrupted\u0027 filesystems, including\n checks for multiply linked directories and directory loops.\n * Options that may cause filesystems to be unmountable have\n been moved into a new \u0027experts\u0027 category in the Mksquashfs\n help text (and Manpage).\n * Maximum cpiostyle filename limited to PATH_MAX. This\n prevents attempts to overflow the stack, or cause system\n calls to fail with a too long pathname.\n * Don\u0027t always use \u0027max open file limit\u0027 when calculating\n length of queues, as a very large file limit can cause\n Unsquashfs to abort. Instead use the smaller of max open\n file limit and cache size.\n * Fix Mksquashfs silently ignoring Pseudo file definitions\n when appending.\n * Don\u0027t abort if no XATTR support has been built in, and\n there\u0027s XATTRs in the filesystem. This is a regression\n introduced in 2019 in Version 4.4.\n * Fix duplicate check when the last file block is sparse.\n\nupdate to 4.5:\n\n * Mksquashfs now supports \u0027Actions\u0027.\n * New sqfstar command which will create a Squashfs image from a tar archive.\n * Tar style handling of source pathnames in Mksquashfs.\n * Cpio style handling of source pathnames in Mksquashfs.\n * New option to throttle the amount of CPU and I/O.\n * Mksquashfs now allows no source directory to be specified.\n * New Pseudo file \u0027R\u0027 definition which allows a Regular file\n o be created with data stored within the Pseudo file.\n * Symbolic links are now followed in extract files\n * Unsquashfs now supports \u0027exclude\u0027 files.\n * Max depth traversal option added.\n * Unsquashfs can now output a \u0027Pseudo file\u0027 representing the\n input Squashfs filesystem.\n * New -one-file-system option in Mksquashfs.\n * New -no-hardlinks option in Mksquashfs.\n * Exit code in Unsquashfs changed to distinguish between\n non-fatal errors (exit 2), and fatal errors (exit 1).\n * Xattr id count added in Unsquashfs \u0027-stat\u0027 output.\n * Unsquashfs \u0027write outside directory\u0027 exploit fixed.\n * Error handling in Unsquashfs writer thread fixed.\n * Fix failure to truncate destination if appending aborted.\n * Prevent Mksquashfs reading the destination file. \n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2024-2463,SUSE-SLE-Micro-5.5-2024-2463",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_2463-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2024:2463-1",
"url": "https://www.suse.com/support/update/announcement/2024/suse-su-20242463-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2024:2463-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2024-July/035988.html"
},
{
"category": "self",
"summary": "SUSE Bug 1189936",
"url": "https://bugzilla.suse.com/1189936"
},
{
"category": "self",
"summary": "SUSE Bug 1190531",
"url": "https://bugzilla.suse.com/1190531"
},
{
"category": "self",
"summary": "SUSE Bug 935380",
"url": "https://bugzilla.suse.com/935380"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4645 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4645/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-4646 page",
"url": "https://www.suse.com/security/cve/CVE-2015-4646/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-40153 page",
"url": "https://www.suse.com/security/cve/CVE-2021-40153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41072 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41072/"
}
],
"title": "Security update for squashfs",
"tracking": {
"current_release_date": "2024-07-12T13:55:05Z",
"generator": {
"date": "2024-07-12T13:55:05Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2024:2463-1",
"initial_release_date": "2024-07-12T13:55:05Z",
"revision_history": [
{
"date": "2024-07-12T13:55:05Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"product": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"product_id": "squashfs-4.6.1-150300.3.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "squashfs-4.6.1-150300.3.3.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
},
"product_reference": "squashfs-4.6.1-150300.3.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-4645",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4645"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4645",
"url": "https://www.suse.com/security/cve/CVE-2015-4645"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4645",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-07-12T13:55:05Z",
"details": "moderate"
}
],
"title": "CVE-2015-4645"
},
{
"cve": "CVE-2015-4646",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-4646"
}
],
"notes": [
{
"category": "general",
"text": "(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-4646",
"url": "https://www.suse.com/security/cve/CVE-2015-4646"
},
{
"category": "external",
"summary": "SUSE Bug 935380 for CVE-2015-4646",
"url": "https://bugzilla.suse.com/935380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-07-12T13:55:05Z",
"details": "moderate"
}
],
"title": "CVE-2015-4646"
},
{
"cve": "CVE-2021-40153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-40153"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-40153",
"url": "https://www.suse.com/security/cve/CVE-2021-40153"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-40153",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-07-12T13:55:05Z",
"details": "moderate"
}
],
"title": "CVE-2021-40153"
},
{
"cve": "CVE-2021-41072",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41072"
}
],
"notes": [
{
"category": "general",
"text": "squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41072",
"url": "https://www.suse.com/security/cve/CVE-2021-41072"
},
{
"category": "external",
"summary": "SUSE Bug 1189936 for CVE-2021-41072",
"url": "https://bugzilla.suse.com/1189936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.5:squashfs-4.6.1-150300.3.3.1.ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-07-12T13:55:05Z",
"details": "moderate"
}
],
"title": "CVE-2021-41072"
}
]
}
CNVD-2021-67506
Vulnerability from cnvd - Published: 2021-09-02
VLAI Severity ?
Title
Squashfs-Tools存在未明漏洞
Description
Squashfs-Tools是一个开源软件包。
Squashfs-Tools4.5版本存在安全漏洞，该漏洞源于在软件中的unsquash-1.c中的squashfs_opendir函数负责存储目录条目中的文件名，然后unsquashfs使用它在unsquash期间创建新文件。函数文件名操作对于目标目录外的遍历并不进行验证，攻击者可利用该漏洞将文件名被允许写入到目标目录外的位置。
Severity
高
Patch Name
Squashfs-Tools存在未明漏洞的补丁
Patch Description
Squashfs-Tools是一个开源软件包。
Squashfs-Tools4.5版本存在安全漏洞，该漏洞源于在软件中的unsquash-1.c中的squashfs_opendir函数负责存储目录条目中的文件名，然后unsquashfs使用它在unsquash期间创建新文件。函数文件名操作对于目标目录外的遍历并不进行验证，攻击者可利用该漏洞将文件名被允许写入到目标目录外的位置。 目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
Reference
https://github.com/plougher/squashfs-tools/issues/72
Impacted products
| Name | Squashfs-Tools Squashfs-Tools 4.5 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2021-40153"
}
},
"description": "Squashfs-Tools\u662f\u4e00\u4e2a\u5f00\u6e90\u8f6f\u4ef6\u5305\u3002\n\nSquashfs-Tools4.5\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u8f6f\u4ef6\u4e2d\u7684unsquash-1.c\u4e2d\u7684squashfs_opendir\u51fd\u6570\u8d1f\u8d23\u5b58\u50a8\u76ee\u5f55\u6761\u76ee\u4e2d\u7684\u6587\u4ef6\u540d\uff0c\u7136\u540eunsquashfs\u4f7f\u7528\u5b83\u5728unsquash\u671f\u95f4\u521b\u5efa\u65b0\u6587\u4ef6\u3002\u51fd\u6570\u6587\u4ef6\u540d\u64cd\u4f5c\u5bf9\u4e8e\u76ee\u6807\u76ee\u5f55\u5916\u7684\u904d\u5386\u5e76\u4e0d\u8fdb\u884c\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6587\u4ef6\u540d\u88ab\u5141\u8bb8\u5199\u5165\u5230\u76ee\u6807\u76ee\u5f55\u5916\u7684\u4f4d\u7f6e\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-67506",
"openTime": "2021-09-02",
"patchDescription": "Squashfs-Tools\u662f\u4e00\u4e2a\u5f00\u6e90\u8f6f\u4ef6\u5305\u3002\r\n\r\nSquashfs-Tools4.5\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u8f6f\u4ef6\u4e2d\u7684unsquash-1.c\u4e2d\u7684squashfs_opendir\u51fd\u6570\u8d1f\u8d23\u5b58\u50a8\u76ee\u5f55\u6761\u76ee\u4e2d\u7684\u6587\u4ef6\u540d\uff0c\u7136\u540eunsquashfs\u4f7f\u7528\u5b83\u5728unsquash\u671f\u95f4\u521b\u5efa\u65b0\u6587\u4ef6\u3002\u51fd\u6570\u6587\u4ef6\u540d\u64cd\u4f5c\u5bf9\u4e8e\u76ee\u6807\u76ee\u5f55\u5916\u7684\u904d\u5386\u5e76\u4e0d\u8fdb\u884c\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6587\u4ef6\u540d\u88ab\u5141\u8bb8\u5199\u5165\u5230\u76ee\u6807\u76ee\u5f55\u5916\u7684\u4f4d\u7f6e\u3002 \u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Squashfs-Tools\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Squashfs-Tools Squashfs-Tools 4.5"
},
"referenceLink": "https://github.com/plougher/squashfs-tools/issues/72",
"serverity": "\u9ad8",
"submitTime": "2021-08-31",
"title": "Squashfs-Tools\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}
GHSA-98F5-57CR-27P7
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2023-05-30 06:30
VLAI?
Details
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Severity ?
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2021-40153"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-27T15:15:00Z",
"severity": "CRITICAL"
},
"details": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.",
"id": "GHSA-98f5-57cr-27p7",
"modified": "2023-05-30T06:30:17Z",
"published": "2022-05-24T19:12:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40153"
},
{
"type": "WEB",
"url": "https://github.com/plougher/squashfs-tools/issues/72"
},
{
"type": "WEB",
"url": "https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202305-29"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4967"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
MSRC_CVE-2021-40153
Vulnerability from csaf_microsoft - Published: 2021-08-02 00:00 - Updated: 2022-01-20 00:00Summary
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination.
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2021-40153 squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2021/msrc_cve-2021-40153.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination.",
"tracking": {
"current_release_date": "2022-01-20T00:00:00.000Z",
"generator": {
"date": "2025-10-19T22:09:27.536Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2021-40153",
"initial_release_date": "2021-08-02T00:00:00.000Z",
"revision_history": [
{
"date": "2022-01-20T00:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "2.0",
"product": {
"name": "CBL Mariner 2.0",
"product_id": "17086"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 squashfs-tools 4.5.1-1",
"product": {
"name": "\u003ccbl2 squashfs-tools 4.5.1-1",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "cbl2 squashfs-tools 4.5.1-1",
"product": {
"name": "cbl2 squashfs-tools 4.5.1-1",
"product_id": "19474"
}
}
],
"category": "product_name",
"name": "squashfs-tools"
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 squashfs-tools 4.5.1-1 as a component of CBL Mariner 2.0",
"product_id": "17086-1"
},
"product_reference": "1",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 squashfs-tools 4.5.1-1 as a component of CBL Mariner 2.0",
"product_id": "19474-17086"
},
"product_reference": "19474",
"relates_to_product_reference": "17086"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-40153",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "general",
"text": "mitre",
"title": "Assigning CNA"
}
],
"product_status": {
"fixed": [
"19474-17086"
],
"known_affected": [
"17086-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2021-40153 squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2021/msrc_cve-2021-40153.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2022-01-20T00:00:00.000Z",
"details": "4.5.1-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-1"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"17086-1"
]
}
],
"title": "squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination."
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…