CVE-2015-4646 (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.
HighCVSS 7.5
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/squashfs-tools(Debian:12) | < 1:4.3-2 | 1:4.3-2 |
| debian/squashfs-tools(Debian:13) | < 1:4.3-2 | 1:4.3-2 |
| debian/squashfs-tools(Debian:14) | < 1:4.3-2 | 1:4.3-2 |
| squashfs project squashfs | <= 4.3 | No fix listed |
References
- Debian Security Tracker CVE-2015-4646 vendor-advisory
- [oss-security] 20150618 Re: Possible CVE Request: Multiple stack overflows in squashfs-tools and sasquatch mailing-list third-party-advisory vdb-entry
- 75272 third-party-advisory vdb-entry
- github.com third-party-advisory
- GLSA-201701-73 third-party-advisory vendor-advisory
- bugs.debian.org issue-tracking