SUSE-SU-2023:4591-1
- Source
- https://www.suse.com/support/update/announcement/2023/suse-su-20234591-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:4591-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2023:4591-1
- Related
- Published
- 2023-11-27T13:32:32Z
- Modified
- 2023-11-27T13:32:32Z
- Summary
- Security update for squashfs
- Details
-
This update for squashfs fixes the following issues:
- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)
- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)
- CVE-2021-41072: Fixed an issue where an attacker might have been able to write a file outside the destination directory via a symlink (bsc#1190531).
update to 4.6.1:
- Race condition which can cause corruption of the 'fragment table' fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option).
- Fix build failure when the tools are being built without extended attribute (XATTRs) support.
- Fix XATTR error message when an unrecognised prefix is found
- Fix incorrect free of pointer when an unrecognised XATTR prefix is found.
- Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements
- Extended attribute handling improved in Mksquashfs and Sqfstar
- New Pseudo file xattr definition to add extended attributes to files.
- New xattrs-add Action to add extended attributes to files
- Extended attribute handling improved in Unsquashfs
- Other major improvements
- Unsquashfs can now output Pseudo files to standard out.
- Mksquashfs can now input Pseudo files from standard in.
- Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs.
- Pseudo files are now supported by Sqfstar.
- 'Non-anchored' excludes are now supported by Unsquashfs.
update to 4.5.1 (bsc#1190531, CVE-2021-41072):
- This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1).
- The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive).
- CVE-2021-41072 which is a writing outside of destination exploit, has been fixed.
- The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary.
- The number of hard-links written by Unsquashfs is now also displayed in the output summary.
- Unsquashfs will now write to a pre-existing destination directory, rather than aborting.
- Unsquashfs now allows '.' to used as the destination, to extract to the current directory.
- The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks.
- -no-hardlinks option has been implemented for Sqfstar.
- More sanity checking for 'corrupted' filesystems, including checks for multiply linked directories and directory loops.
- Options that may cause filesystems to be unmountable have been moved into a new 'experts' category in the Mksquashfs help text (and Manpage).
- Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname.
- Don't always use 'max open file limit' when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size.
- Fix Mksquashfs silently ignoring Pseudo file definitions when appending.
- Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4.
- Fix duplicate check when the last file block is sparse.
update to 4.5:
- Mksquashfs now supports 'Actions'.
- New sqfstar command which will create a Squashfs image from a tar archive.
- Tar style handling of source pathnames in Mksquashfs.
- Cpio style handling of source pathnames in Mksquashfs.
- New option to throttle the amount of CPU and I/O.
- Mksquashfs now allows no source directory to be specified.
- New Pseudo file 'R' definition which allows a Regular file o be created with data stored within the Pseudo file.
- Symbolic links are now followed in extract files
- Unsquashfs now supports 'exclude' files.
- Max depth traversal option added.
- Unsquashfs can now output a 'Pseudo file' representing the input Squashfs filesystem.
- New -one-file-system option in Mksquashfs.
- New -no-hardlinks option in Mksquashfs.
- Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1).
- Xattr id count added in Unsquashfs '-stat' output.
- Unsquashfs 'write outside directory' exploit fixed.
- Error handling in Unsquashfs writer thread fixed.
- Fix failure to truncate destination if appending aborted.
- Prevent Mksquashfs reading the destination file.
- References
-
- https://www.suse.com/support/update/announcement/2023/suse-su-20234591-1/
- https://bugzilla.suse.com/1189936
- https://bugzilla.suse.com/1190531
- https://bugzilla.suse.com/935380
- https://www.suse.com/security/cve/CVE-2015-4645
- https://www.suse.com/security/cve/CVE-2015-4646
- https://www.suse.com/security/cve/CVE-2021-40153
- https://www.suse.com/security/cve/CVE-2021-41072
Affected packages
SUSE:Linux Enterprise Micro 5.3 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.3
SUSE:Linux Enterprise Micro 5.4 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.4
SUSE:Linux Enterprise Micro 5.5 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.5
SUSE:Linux Enterprise Module for Basesystem 15 SP4 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4
SUSE:Linux Enterprise Module for Basesystem 15 SP5 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS
SUSE:Linux Enterprise Server 15 SP3-LTSS / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3
SUSE:Manager Proxy 4.2 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Manager%20Proxy%204.2
SUSE:Manager Server 4.2 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Manager%20Server%204.2
SUSE:Linux Enterprise Micro 5.1 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.1
SUSE:Linux Enterprise Micro 5.2 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Linux%20Enterprise%20Micro%205.2
SUSE:Enterprise Storage 7.1 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/suse/squashfs&distro=SUSE%20Enterprise%20Storage%207.1
openSUSE:Leap Micro 5.3 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/opensuse/squashfs&distro=openSUSE%20Leap%20Micro%205.3
openSUSE:Leap Micro 5.4 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/opensuse/squashfs&distro=openSUSE%20Leap%20Micro%205.4
openSUSE:Leap 15.4 / squashfs
Package
- Name
- squashfs
- Purl
- pkg:rpm/opensuse/squashfs&distro=openSUSE%20Leap%2015.4