Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2012-4024 Details

Description

Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://exchange.xforce.ibmcloud.com/vulnerabilities/77106	CVE	VDB Entry
http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel	CVE	Third Party Advisory
https://security.gentoo.org/glsa/201612-40	CVE	Third Party Advisory
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001	CVE	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:128	CVE	Not Applicable
http://www.openwall.com/lists/oss-security/2012/07/19/6	CVE	Mailing List
http://www.osvdb.org/83898	CVE	Broken Link
http://www.securityfocus.com/bid/54610	CVE	Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/77106	[email protected]	VDB Entry
http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel	[email protected]	Third Party Advisory
https://security.gentoo.org/glsa/201612-40	[email protected]	Third Party Advisory
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001	[email protected]	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:128	[email protected]	Not Applicable
http://www.openwall.com/lists/oss-security/2012/07/19/6	[email protected]	Mailing List
http://www.osvdb.org/83898	[email protected]	Broken Link
http://www.securityfocus.com/bid/54610	[email protected]	Third Party AdvisoryVDB Entry

see all 16 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-787	Out-of-bounds Write	[email protected]

Affected Products

Product	Versions
squashfs project squashfs	<= 4.2
CPE cpe:2.3:a:squashfs_project:squashfs:::::::: Remediation No remediation found in references.

Change History

15 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 10, 2020	Modified Analysis	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Oct 21, 2019	CPE Deprecation Remap	[email protected]
Dec 1, 2017	CVE Modified	[email protected]
Jul 1, 2017	CVE Modified	[email protected]
Jul 20, 2012	Initial Analysis	[email protected]