{"id":"CVE-2015-4646","aliases":["AZL-6885","DEBIAN-CVE-2015-4646","EUVD-2015-4665","GHSA-m77j-hm9g-ppq8","MGASA-2015-0335","SUSE-SU-2023:4424-1","SUSE-SU-2023:4591-1","SUSE-SU-2024:2463-1","UBUNTU-CVE-2015-4646"],"status":"published","title":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and...","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0691,"percentile":0.94128,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-09-08T07:20:40Z","modified":"2026-09-09T07:01:18Z","fixes":[{"ecosystem":"Azure Linux:2","package":"squashfs-tools","fixed_in":["4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squashfs-tools","fixed_in":["1:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squashfs-tools","fixed_in":["1:4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squashfs-tools","fixed_in":["1:4.3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.3-2"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-7.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"squashfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-4.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-8.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-8.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"squashfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-150300.3.3.1"}]}],"bundled":4}],"products":[{"vendor":"squashfs_project","product":"squashfs"}],"references":[{"url":"http://www.securityfocus.com/bid/75272","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-73","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/oss-sec/2015/q2/756","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","VDB Entry","advisory","article"]},{"url":"https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4646","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m77j-hm9g-ppq8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-4646","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0335.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16427","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-July/162171.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234424-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133284","tags":["report"]},{"url":"https://bugzilla.suse.com/1160294","tags":["report"]},{"url":"https://bugzilla.suse.com/1189936","tags":["report"]},{"url":"https://bugzilla.suse.com/1190531","tags":["report"]},{"url":"https://bugzilla.suse.com/935380","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41072","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234591-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242463-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-4646","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/18/10","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4646","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-4646","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:00:00Z","modified":"2024-08-06T06:18:12.103Z","updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4665","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:00:00Z","modified":"2024-08-06T06:18:12Z","updated_at":"2026-11-03T02:22:03.142599Z"}],"ghsa":[{"id":"GHSA-m77j-hm9g-ppq8","title":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and...","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2022-05-13T01:31:02Z","modified":"2023-02-01T05:07:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:38.356016Z"}],"nvd":[{"id":"CVE-2015-4646","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:59:00.34Z","modified":"2026-06-17T00:27:39.713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"AZL-6885","title":"CVE-2015-4646 affecting package squashfs-tools for versions less than 4.5-1","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:59:00Z","modified":"2026-04-21T04:38:31.116621Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2015-4646","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:59:00Z","modified":"2026-04-16T06:22:16.998676145Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-4646","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"published","published":"2017-04-13T17:59:00.34Z","modified":"2026-09-09T07:01:18.589485915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-4646","description":"(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.","status":"withdrawn","published":"2017-04-13T17:59:00Z","modified":"2025-07-16T07:33:03.399652Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"MGASA-2015-0335","title":"Updated squashfs-tools packages fix security vulnerabilities","description":"Updated squashfs-tools package fixes security vulnerabilities:\n\nThe unsquashfs command from squashfs-tools is vulnerable to integer\n(CVE-2015-4645) and stack (CVE-2015-4646) overflows.\n","status":"published","published":"2015-09-08T07:20:40Z","modified":"2026-04-16T06:24:10.843330114Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2023:4424-1","title":"Security update for squashfs","description":"This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been\n  able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n  able to write a file outside the destination directory via a\n  symlink (bsc#1190531).\n","status":"published","published":"2023-11-13T12:12:08Z","modified":"2026-02-04T04:06:53.577441Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4591-1","title":"Security update for squashfs","description":"This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n  able to write a file outside the destination directory via a\n  symlink (bsc#1190531).\n\nupdate to 4.6.1:\n\n  * Race condition which can cause corruption of the 'fragment\n    table' fixed.  This is a regression introduced in August 2022,\n    and it has been seen when tailend packing is used (-tailends option).\n  * Fix build failure when the tools are being built without\n    extended attribute (XATTRs) support.\n  * Fix XATTR error message when an unrecognised prefix is\n    found\n  * Fix incorrect free of pointer when an unrecognised XATTR\n    prefix is found.\n  * Major improvements in extended attribute handling,\n    pseudo file handling, and miscellaneous new options and\n    improvements\n  * Extended attribute handling improved in Mksquashfs and\n    Sqfstar\n  * New Pseudo file xattr definition to add extended\n    attributes to files.\n  * New xattrs-add Action to add extended attributes to files\n  * Extended attribute handling improved in Unsquashfs\n  * Other major improvements\n  * Unsquashfs can now output Pseudo files to standard out.\n  * Mksquashfs can now input Pseudo files from standard in.\n  * Squashfs filesystems can now be converted (different\n    block size compression etc) without unpacking to an\n    intermediate filesystem or mounting, by piping the output of\n    Unsquashfs to Mksquashfs.\n  * Pseudo files are now supported by Sqfstar.\n  * 'Non-anchored' excludes are now supported by Unsquashfs.\n\nupdate to 4.5.1 (bsc#1190531, CVE-2021-41072):\n\n  * This release adds Manpages for Mksquashfs(1), Unsquashfs(1),\n    Sqfstar(1) and Sqfscat(1).\n  * The -help text output from the utilities has been improved\n    and extended as well (but the Manpages are now more\n    comprehensive).\n  * CVE-2021-41072 which is a writing outside of destination\n    exploit, has been fixed.\n  * The number of hard-links in the filesystem is now also\n    displayed by Mksquashfs in the output summary.\n  * The number of hard-links written by Unsquashfs is now\n    also displayed in the output summary.\n  * Unsquashfs will now write to a pre-existing destination\n    directory, rather than aborting.\n  * Unsquashfs now allows '.' to used as the destination, to\n    extract to the current directory.\n  * The Unsquashfs progress bar now tracks empty files and\n    hardlinks, in addition to data blocks.\n  * -no-hardlinks option has been implemented for Sqfstar.\n  * More sanity checking for 'corrupted' filesystems, including\n    checks for multiply linked directories and directory loops.\n  * Options that may cause filesystems to be unmountable have\n    been moved into a new 'experts' category in the Mksquashfs\n    help text (and Manpage).\n  * Maximum cpiostyle filename limited to PATH_MAX.  This\n    prevents attempts to overflow the stack, or cause system\n    calls to fail with a too long pathname.\n  * Don't always use 'max open file limit' when calculating\n    length of queues, as a very large file limit can cause\n    Unsquashfs to abort.  Instead use the smaller of max open\n    file limit and cache size.\n  * Fix Mksquashfs silently ignoring Pseudo file definitions\n    when appending.\n  * Don't abort if no XATTR support has been built in, and\n    there's XATTRs in the filesystem.  This is a regression\n    introduced in 2019 in Version 4.4.\n  * Fix duplicate check when the last file block is sparse.\n\nupdate to 4.5:\n\n  * Mksquashfs now supports 'Actions'.\n  * New sqfstar command which will create a Squashfs image from a tar archive.\n  * Tar style handling of source pathnames in Mksquashfs.\n  * Cpio style handling of source pathnames in Mksquashfs.\n  * New option to throttle the amount of CPU and I/O.\n  * Mksquashfs now allows no source directory to be specified.\n  * New Pseudo file 'R' definition which allows a Regular file\n    o be created with data stored within the Pseudo file.\n  * Symbolic links are now followed in extract files\n  * Unsquashfs now supports 'exclude' files.\n  * Max depth traversal option added.\n  * Unsquashfs can now output a 'Pseudo file' representing the\n    input Squashfs filesystem.\n  * New -one-file-system option in Mksquashfs.\n  * New -no-hardlinks option in Mksquashfs.\n  * Exit code in Unsquashfs changed to distinguish between\n    non-fatal errors (exit 2), and fatal errors (exit 1).\n  * Xattr id count added in Unsquashfs '-stat' output.\n  * Unsquashfs 'write outside directory' exploit fixed.\n  * Error handling in Unsquashfs writer thread fixed.\n  * Fix failure to truncate destination if appending aborted.\n  * Prevent Mksquashfs reading the destination file. \n","status":"published","published":"2023-11-27T13:32:32Z","modified":"2026-02-04T04:06:57.682639Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:2463-1","title":"Security update for squashfs","description":"This update for squashfs fixes the following issues:\n\n- CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-tools (bsc#935380)\n- CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936)\n- CVE-2021-41072: Fixed an issue where an attacker might have been\n  able to write a file outside the destination directory via a\n  symlink (bsc#1190531).\n\nupdate to 4.6.1:\n\n  * Race condition which can cause corruption of the 'fragment\n    table' fixed.  This is a regression introduced in August 2022,\n    and it has been seen when tailend packing is used (-tailends option).\n  * Fix build failure when the tools are being built without\n    extended attribute (XATTRs) support.\n  * Fix XATTR error message when an unrecognised prefix is\n    found\n  * Fix incorrect free of pointer when an unrecognised XATTR\n    prefix is found.\n  * Major improvements in extended attribute handling,\n    pseudo file handling, and miscellaneous new options and\n    improvements\n  * Extended attribute handling improved in Mksquashfs and\n    Sqfstar\n  * New Pseudo file xattr definition to add extended\n    attributes to files.\n  * New xattrs-add Action to add extended attributes to files\n  * Extended attribute handling improved in Unsquashfs\n  * Other major improvements\n  * Unsquashfs can now output Pseudo files to standard out.\n  * Mksquashfs can now input Pseudo files from standard in.\n  * Squashfs filesystems can now be converted (different\n    block size compression etc) without unpacking to an\n    intermediate filesystem or mounting, by piping the output of\n    Unsquashfs to Mksquashfs.\n  * Pseudo files are now supported by Sqfstar.\n  * 'Non-anchored' excludes are now supported by Unsquashfs.\n\nupdate to 4.5.1 (bsc#1190531, CVE-2021-41072):\n\n  * This release adds Manpages for Mksquashfs(1), Unsquashfs(1),\n    Sqfstar(1) and Sqfscat(1).\n  * The -help text output from the utilities has been improved\n    and extended as well (but the Manpages are now more\n    comprehensive).\n  * CVE-2021-41072 which is a writing outside of destination\n    exploit, has been fixed.\n  * The number of hard-links in the filesystem is now also\n    displayed by Mksquashfs in the output summary.\n  * The number of hard-links written by Unsquashfs is now\n    also displayed in the output summary.\n  * Unsquashfs will now write to a pre-existing destination\n    directory, rather than aborting.\n  * Unsquashfs now allows '.' to used as the destination, to\n    extract to the current directory.\n  * The Unsquashfs progress bar now tracks empty files and\n    hardlinks, in addition to data blocks.\n  * -no-hardlinks option has been implemented for Sqfstar.\n  * More sanity checking for 'corrupted' filesystems, including\n    checks for multiply linked directories and directory loops.\n  * Options that may cause filesystems to be unmountable have\n    been moved into a new 'experts' category in the Mksquashfs\n    help text (and Manpage).\n  * Maximum cpiostyle filename limited to PATH_MAX.  This\n    prevents attempts to overflow the stack, or cause system\n    calls to fail with a too long pathname.\n  * Don't always use 'max open file limit' when calculating\n    length of queues, as a very large file limit can cause\n    Unsquashfs to abort.  Instead use the smaller of max open\n    file limit and cache size.\n  * Fix Mksquashfs silently ignoring Pseudo file definitions\n    when appending.\n  * Don't abort if no XATTR support has been built in, and\n    there's XATTRs in the filesystem.  This is a regression\n    introduced in 2019 in Version 4.4.\n  * Fix duplicate check when the last file block is sparse.\n\nupdate to 4.5:\n\n  * Mksquashfs now supports 'Actions'.\n  * New sqfstar command which will create a Squashfs image from a tar archive.\n  * Tar style handling of source pathnames in Mksquashfs.\n  * Cpio style handling of source pathnames in Mksquashfs.\n  * New option to throttle the amount of CPU and I/O.\n  * Mksquashfs now allows no source directory to be specified.\n  * New Pseudo file 'R' definition which allows a Regular file\n    o be created with data stored within the Pseudo file.\n  * Symbolic links are now followed in extract files\n  * Unsquashfs now supports 'exclude' files.\n  * Max depth traversal option added.\n  * Unsquashfs can now output a 'Pseudo file' representing the\n    input Squashfs filesystem.\n  * New -one-file-system option in Mksquashfs.\n  * New -no-hardlinks option in Mksquashfs.\n  * Exit code in Unsquashfs changed to distinguish between\n    non-fatal errors (exit 2), and fatal errors (exit 1).\n  * Xattr id count added in Unsquashfs '-stat' output.\n  * Unsquashfs 'write outside directory' exploit fixed.\n  * Error handling in Unsquashfs writer thread fixed.\n  * Fix failure to truncate destination if appending aborted.\n  * Prevent Mksquashfs reading the destination file. \n","status":"published","published":"2024-07-12T13:55:05Z","modified":"2026-02-04T03:47:30.033977Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}