https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:05:34 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:2396 <p><strong>Affected:</strong> AlmaLinux:9: squashfs-tools</p> <p>SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.</p> <p>Security Fix(es):</p> <p>* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153) * squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: squashfs-tools</p> <p>SquashFS is a highly compressed read-only file system for Linux. These packages contain the utilities for manipulating squashfs file systems.</p> <p>Security Fix(es):</p> <p>* squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153) * squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:2396 https://cve.radiocsirt.org/vuln/bdu:2021-05217 bdu:2021-05217 https://cve.radiocsirt.org/vuln/bdu:2021-05217 https://cve.radiocsirt.org/vuln/bell-cve-2021-40153 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-40153 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/cnvd-2021-67506 cnvd-2021-67506 https://cve.radiocsirt.org/vuln/cnvd-2021-67506 https://cve.radiocsirt.org/vuln/euvd-2026-31084 EUVD-2026-31084 https://cve.radiocsirt.org/vuln/euvd-2026-31084 https://cve.radiocsirt.org/vuln/fkie_cve-2021-40153 <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-40153 https://cve.radiocsirt.org/vuln/ghsa-98f5-57cr-27p7 <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> https://cve.radiocsirt.org/vuln/ghsa-98f5-57cr-27p7 https://cve.radiocsirt.org/vuln/gsd-2021-40153 gsd-2021-40153 https://cve.radiocsirt.org/vuln/gsd-2021-40153 https://cve.radiocsirt.org/vuln/msrc_cve-2021-40153 msrc_CVE-2021-40153 https://cve.radiocsirt.org/vuln/msrc_cve-2021-40153 https://cve.radiocsirt.org/vuln/oesa-2021-1425 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: squashfs-tools, openEuler:20.03-LTS-SP2: squashfs-tools</p> <p>Squashfs is a highly compressed read-only filesystem for Linux. It uses either gzip/xz/lzo/lz4/zstd compression to compress both files, inodes and directories. Security Fix(es): squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.(CVE-2021-41072) squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.(CVE-2021-40153)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: squashfs-tools, openEuler:20.03-LTS-SP2: squashfs-tools</p> <p>Squashfs is a highly compressed read-only filesystem for Linux. It uses either gzip/xz/lzo/lz4/zstd compression to compress both files, inodes and directories. Security Fix(es): squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.(CVE-2021-41072) squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.(CVE-2021-40153)</p> https://cve.radiocsirt.org/vuln/oesa-2021-1425 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13035-1 <p>squashfs-4.6.1-2.1 on GA media</p> <p>squashfs-4.6.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13035-1 https://cve.radiocsirt.org/vuln/suse-su-2023:4424-1 <p>Security update for squashfs</p> <p>Security update for squashfs</p> https://cve.radiocsirt.org/vuln/suse-su-2023:4424-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-40153 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: squashfs-tools, Ubuntu:18.04:LTS: squashfs-tools, Ubuntu:20.04:LTS: squashfs-tools</p> <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: squashfs-tools, Ubuntu:18.04:LTS: squashfs-tools, Ubuntu:20.04:LTS: squashfs-tools</p> <p>squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-40153 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0995 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0995