Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-40153 →
DEBIAN-CVE-2021-40153
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new f...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
squashfs-tools
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.5-2"}]}]
Debian:13
squashfs-tools
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.5-2"}]}]
Debian:14
squashfs-tools
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.5-2"}]}]
Références
- advisory security-tracker.debian.org