Debian 11: binwalk Critical Path Traversal RCE DLA-4410-1 CVE-2022-4510

A path traversal vulnerability was identified in binwalk. By crafting
a malicious PFS filesystem file, an attacker can get binwalk's PFS
extractor to extract files at arbitrary locations when binwalk is run
in extraction mode (-e option). Remote code execution can be achieved
by building a PFS filesystem that, upon extraction, would extract a
malicious binwalk module into the folder .config/binwalk/plugins.

For Debian 11 bullseye, this problem has been fixed in version
2.3.1+dfsg1-1+deb11u1.

We recommend that you upgrade your binwalk packages.

For the detailed security status of binwalk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/binwalk

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS