1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202305-29 ] squashfs-tools: Multiple Vulnerabi

    From glsamaker@gentoo.org@21:1/5 to All on Tue May 30 05:10:01 2023
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202305-29
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: Normal
    Title: squashfs-tools: Multiple Vulnerabilities
    Date: May 30, 2023
    Bugs: #810706, #813654
    ID: 202305-29

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Multiple vulnerabilities have been discovered in squashfs-tools, the
    worst of which can result in an arbitrary file write.

    Background
    ==========

    Squashfs is a compressed read-only filesystem for Linux. Squashfs is
    intended for general read-only filesystem use, for archival use (i.e. in
    cases where a .tar.gz file may be used), and in constrained block
    device/memory systems (e.g. embedded systems) where low overhead is
    needed.

    Affected packages
    =================

    Package Vulnerable Unaffected
    --------------------- --------------- ----------------
    sys-fs/squashfs-tools < 4.5_p20210914 >= 4.5_p20210914

    Description
    ===========

    Multiple vulnerabilities have been discovered in squashfs-tools. Please
    review the CVE identifiers referenced below for details.

    Impact
    ======

    Please review the referenced CVE identifiers for details.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All squashfs-tools users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-fs/squashfs-tools-4.5_p20210914"

    References
    ==========

    [ 1 ] CVE-2021-40153
    https://nvd.nist.gov/vuln/detail/CVE-2021-40153
    [ 2 ] CVE-2021-41072
    https://nvd.nist.gov/vuln/detail/CVE-2021-41072

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202305-29

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2023 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmR1ZWgACgkQFMQkOaVy +9kHrw/+NhOuZVIf85+ZgyXQRB10IhKwGx77zPxQ+tOSzkcpaPAT3J6WAo9dYdg3 f4R/ZF3cviuH4cWa1wotLtSZ+OaTgwRQd1koLjGPB7iRomfoYRiW1we8fyqeLDdv bnnMmEvzy9++EQ6mPcThttL2MmC7AMxMImwJ5jdF2AQN0wFTunI/webHLnGCzFrk UZlB+yJhfgqPne4RKs0Ghp+U3/XPJIp0X7w8TcD1laInvzhVCx6R37hC9736gD8u EOOk8sIgTpJqZa/51Tyf6uN8fZn5qYyLnktd2Xho5hu2c/IBCta+EflnfktSOvWJ 4JbPhv+36AHPkmeOx+p3BLDGIqOPabHEJRtKEmuMsG5EkHv2hybqVa3JSgSP9pyV LzUkXH+tC1HpUg+paAV0w+67uyrvNi6C5Zj7cj8UNo8Jz8QNLbzRnUuE7z+mOlPa KkRxmfqet4rFV8HXp/h4b4F17Gx2SMQlSYSq0G7fkeCNQFp/yFMRrrvF+ICddp6Q zrWiANyyDhkMu6Zz3pELGaAro6twucF9dOUDMX9qTMTGd99HogzmRFQ5nilpM8FD Fu0hk3HnVCA7I2XH3Gbvlz1e91072RqNel4GAL6kWwNCxKxOW1NCgd+aoDH+15zS +UmS3I3rjJVGTytcEFIWdJJPyGTwg5/NcHOaxMjXYgEuN6ps104=
    =DAw6
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)