CVE-2012-4024
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in...
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- Updated
- 2026-11-02
EUVDEUVD-2012-3968 No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
EUVD-2012-3968- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5cx-4556-w7x7 No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in...
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
GHSA-r5cx-4556-w7x7- Weakness
- CWE-787
- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4024 No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
DEBIAN-CVE-2012-4024- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10201-1 No score
squashfs-4.3-9.3 on GA media
These are all security issues fixed in the squashfs-4.3-9.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10201-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squashfs-toolsDebian:12 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:13 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:14 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfsopenSUSE:Tumbleweed |
before 4.3-9.3 | 4.3-9.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4024 is a medium vulnerability (CVSS 6.8) in Squashfs Project Squashfs, published July 19, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.05%, the 90th percentile. Fixed in squashfs-tools 1:4.2+20121212-1.
References
openwall.com/lists/oss-security/2012/07/19/6
osvdb.org/83898
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
securityfocus.com/bid/54610
security.gentoo.org/glsa/201612-40
Show 7 moreShow less
mandriva.com/security/advisories?name=MDVSA-2013:128
exchange.xforce.ibmcloud.com/vulnerabilities/77106
nvd.nist.gov/vuln/detail/CVE-2012-4024
github.com/advisories/GHSA-r5cx-4556-w7x7
security-tracker.debian.org/tracker/CVE-2012-4024
suse.com/security/cve/CVE-2012-4024