Input validation error in squashfs-tools - CVE-2015-4646

Vulnerability identifier: #VU83033

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-4646

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in unsquash-1.c, unsquash-2.c, unsquash-3.c, and unsquash-4.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

squashfs-tools
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Slackware Linux
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
Fedora
squashfs-tools
sys-fs/squashfs-tools
squashfs-debuginfo
squashfs
squashfs-debugsource

Install updates from vendor's website.

squashfs-tools - update to 4.4
squashfs-tools - update to 4.3
sys-fs/squashfs-tools - update to 4.3-r1
squashfs-tools - addressed in versions 4.3-11.fc21, 4.3-11.fc22
squashfs-debuginfo - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1
squashfs - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1
squashfs-debugsource - addressed in versions 4.6.1-8.3.2, 4.6.1-150300.3.3.1

• http://seclists.org/oss-sec/2015/q2/756
• http://www.securityfocus.com/bid/75272
• https://github.com/plougher/squashfs-tools/commit/f95864afe8833fe3ad782d714b41378e860977b1
• https://security.gentoo.org/glsa/201701-73

• Multiple vulnerabilities in squashfs-tools
• SUSE update for squashfs
• SUSE update for squashfs
• Gentoo update for SQUASHFS
• Slackware Linux update for squashfs-tools
• Fedora 22 update for squashfs-tools
• Fedora 21 update for squashfs-tools