CVE-2012-4024
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in...
CVE-2012-4024 is a medium vulnerability (CVSS 6.8) in Squashfs Project Squashfs, published July 19, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.05%, the 90th percentile. Fixed in squashfs-tools 1:4.2+20121212-1.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 4.05%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:4.2+20121212-1squashfs-tools +3 more
Description
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squashfs-toolsDebian:12 | before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:13 | before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfs-toolsDebian:14 | before 1:4.2+20121212-1 | 1:4.2+20121212-1 |
squashfsopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 4.3-9.3 | 4.3-9.3 |
What each source reports
NVD Score used
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE ListNo score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- Updated
- 2026-11-02
EUVDEUVD-2012-3968No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
EUVD-2012-3968- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5cx-4556-w7x7No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in...
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
GHSA-r5cx-4556-w7x7- Weakness
- CWE-787
- Updated
- 2026-11-02
OSVNo score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
CVE-2012-4024- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4024No score
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
- Record
DEBIAN-CVE-2012-4024- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10201-1No score
squashfs-4.3-9.3 on GA media
These are all security issues fixed in the squashfs-4.3-9.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10201-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2012/07/19/6
osvdb.org/83898
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001
sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel
securityfocus.com/bid/54610
security.gentoo.org/glsa/201612-40
Show 7 moreShow less
mandriva.com/security/advisories?name=MDVSA-2013:128
exchange.xforce.ibmcloud.com/vulnerabilities/77106
nvd.nist.gov/vuln/detail/CVE-2012-4024
github.com/advisories/GHSA-r5cx-4556-w7x7
security-tracker.debian.org/tracker/CVE-2012-4024
suse.com/security/cve/CVE-2012-4024