CVE-2012-4025
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and...
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
CVE-2012-4025- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
CVE-2012-4025- Updated
- 2026-11-02
EUVDEUVD-2012-3969 No score
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
EUVD-2012-3969- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-978f-5qgh-63fx No score
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and...
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
GHSA-978f-5qgh-63fx- Weakness
- CWE-190
- Updated
- 2026-11-02
OSV No score
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
CVE-2012-4025- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4025 No score
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
- Record
DEBIAN-CVE-2012-4025- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10201-1 No score
squashfs-4.3-9.3 on GA media
These are all security issues fixed in the squashfs-4.3-9.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10201-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squashfs-toolsDebian:12 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:13 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:14 |
before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfsopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.3-9.3 | 4.3-9.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4025 is a medium vulnerability (CVSS 6.8) in Squashfs Project Squashfs, published July 19, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.90%, the 90th percentile. Fixed in squashfs-tools 1:4.2+20121212-1.
References
openwall.com/lists/oss-security/2012/07/19/6
osvdb.org/83899
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
securityfocus.com/bid/54610
security.gentoo.org/glsa/201612-40