CVE-2021-40153
Summary
| CVE | CVE-2021-40153 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-08-27 15:15:00 UTC |
|---|
| Updated | 2023-11-07 03:38:00 UTC |
|---|
| Description | squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Debian -- Security Information -- DSA-4967-1 squashfs-tools |
DEBIAN |
www.debian.org |
|
| [SECURITY] [DLA 2752-1] squashfs-tools security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 33 Update: squashfs-tools-4.5-3.20210913gite048580.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: squashfs-tools-4.5-2.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Unsquashfs: fix write outside destination directory exploit · plougher/squashfs-tools@79b5a55 · GitHub |
MISC |
github.com |
|
| Error: Page not found |
MISC |
bugs.launchpad.net |
|
| squashfs-tools: Multiple Vulnerabilities (GLSA 202305-29) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 34 Update: squashfs-tools-4.5-2.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: squashfs-tools-4.5-3.20210913gite048580.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| unsquashfs - unvalidated filepaths allow writing outside of destination · Issue #72 · plougher/squashfs-tools · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178783 Debian Security Update for squashfs-tools (DSA 4967-1)
- 178848 Debian Security Update for squashfs-tools (DLA 2752-1)
- 183809 Debian Security Update for squashfs-tools (CVE-2021-40153)
- 198475 Ubuntu Security Notification for Squashfs-Tools Vulnerability (USN-5057-1)
- 281858 Fedora Security Update for squashfs (FEDORA-2021-cdbd827c1e)
- 281940 Fedora Security Update for squashfs (FEDORA-2021-9fb6da134f)
- 355609 Amazon Linux Security Advisory for squashfs-tools : ALAS2-2023-2152
- 500656 Alpine Linux Security Update for squashfs-tools
- 504424 Alpine Linux Security Update for squashfs-tools
- 670832 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2698)
- 670833 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2723)
- 670954 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2674)
- 671028 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2645)
- 671232 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1189)
- 710736 Gentoo Linux squashfs-tools Multiple Vulnerabilities (GLSA 202305-29)
- 755254 SUSE Enterprise Linux Security Update for squashfs (SUSE-SU-2023:4424-1)
- 901638 Common Base Linux Mariner (CBL-Mariner) Security Update for squashfs-tools (7463-1)
