Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

SUSE: 2023:4591-1 important: squashfs buffer overflow issues remedied

suse
Calendar Grey November 27, 2023
Dist Suse Esm H88
To tackle various serious vulnerabilities affecting multiple distributions, it is crucial to update the central squashfs package on SUSE for improved security and system stability
* bsc#1189936 * bsc#1190531 * bsc#935380 Cross-References:

Summary

## This update for squashfs fixes the following issues: * CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs- tools (bsc#935380) * CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936) * CVE-2021-41072: Fixed an issue where an attacker might have been able to write a file outside the destination directory via a symlink (bsc#1190531). update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found

Topics%20covered

Topics Covered

security advisory buffer overflow critical patch suse squashfs

References

* bsc#1189936

* bsc#1190531

* bsc#935380

Cross-

* CVE-2015-4645

* CVE-2015-4646

* CVE-2021-40153

* CVE-2021-41072

CVSS scores:

* CVE-2015-4645 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2015-4645 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2015-4646 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2021-40153 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

* CVE-2021-40153 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

* CVE-2021-41072 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

* CVE-2021-41072 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected Products:

* Basesystem Module 15-SP4

* Basesystem Module 15-SP5

* openSUSE Leap 15.3

* openSUSE Leap 15.4

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:4591-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow critical patch suse squashfs

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here