CVE-2015-4645 Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which tri...
MediumCVSS 5.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/squashfs-tools(Debian:12) | < 1:4.3-2 | 1:4.3-2 |
| debian/squashfs-tools(Debian:13) | < 1:4.3-2 | 1:4.3-2 |
| debian/squashfs-tools(Debian:14) | < 1:4.3-2 | 1:4.3-2 |
| squashfs project squashfs | <= 4.3 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
References
- Debian Security Tracker CVE-2015-4645 vendor-advisory
- FEDORA-2015-10750 third-party-advisory vendor-advisory
- FEDORA-2015-10760 third-party-advisory vendor-advisory
- 75272 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com third-party-advisory
- github.com third-party-advisory
- GLSA-201701-73 third-party-advisory vdb-entry vendor-advisory
- bugs.debian.org issue-tracking