CVE-2012-4024
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
Un desbordamiento de búfer basado en pila en la función get_component en unsquashfs.c en unsquashfs en Squashfs v4.2 y anteriores permite a atacantes remotos ejecutar código de su elección mediante un archivo de lista hecho a mano (hecho para la opción -ef). NOTA: Probablemente en la mayoría de los casos, el archivo de lista es un archivo de confianza construido por el usuario del programa, sin embargo, hay algunas situaciones reales en las que sería un archivo de lista obtenido a partir de una fuente remota no confiable.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-07-16 CVE Reserved
- 2012-07-19 CVE Published
- 2024-02-17 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel | Third Party Advisory | |
| http://www.openwall.com/lists/oss-security/2012/07/19/6 | Mailing List |
|
| http://www.osvdb.org/83898 | Broken Link | |
| http://www.securityfocus.com/bid/54610 | Third Party Advisory | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/77106 | Vdb Entry | |
| https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:128 | 2020-01-10 | |
| https://security.gentoo.org/glsa/201612-40 | 2020-01-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Squashfs Project Search vendor "Squashfs Project" | Squashfs Search vendor "Squashfs Project" for product "Squashfs" | <= 4.2 Search vendor "Squashfs Project" for product "Squashfs" and version " <= 4.2" | - |
Affected
| ||||||