Bug 810706 (CVE-2021-40153) – <sys-fs/squashfs-tools-4.5: directory traversal (CVE-2021-40153)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2021-08-27 19:46:22 UTC]

CVE-2021-40153:

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.

Patch: https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646

[Comment 1 John Helmert III 2021-08-27 19:51:40 UTC]

Please file a stablereq when ready. Patch is in 4.5.

[Comment 2 John Helmert III 2021-09-04 21:55:54 UTC]

Please cleanup.

[Comment 3 Michał Górny 2021-09-04 22:07:55 UTC]

cleanup done.

[Comment 4 John Helmert III 2023-05-29 23:42:51 UTC]

GLSA request filed

[Comment 5 Larry the Git Cow 2023-05-30 02:56:47 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=7c5aee9146a9230980d95e7d2037c660f20dd275

commit 7c5aee9146a9230980d95e7d2037c660f20dd275
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-05-30 02:54:28 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2023-05-30 02:56:35 +0000

    [ GLSA 202305-29 ] squashfs-tools: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/810706
    Bug: https://bugs.gentoo.org/813654
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202305-29.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

[Comment 6 John Helmert III 2023-05-30 03:00:02 UTC]

GLSA released, all done!