CVE-2015-4645: Buffer Overflow
Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
Other sources
Integer overflow issue was reported in squashfs-tools. Following code in unsquash-4.c overflows the bytes variable, so that the allocation of fragmentsbytes[] has an erroneous size.
int bytes = SQUASHFSFRAGMENTBYTES(sBlk.s.fragments); ... fragmenttable = malloc(bytes)
Upstream bug report: https://github.com/devttys0/sasquatch/pull/5 Upstream fix: https://github.com/gcanalesb/sasquatch/commit/6777e08cc38bc780d27c69c1d8c272867b74524f
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sasquatchto a version that resolves this vulnerability.Patch 6777e08cc38bc780d27c69c1d8c272867b74524f
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4645?
CVE-2015-4645 is classified as a medium severity vulnerability that can lead to denial of service.
How do I fix CVE-2015-4645?
To fix CVE-2015-4645, update Squashfs to the latest version that addresses this integer overflow issue.
What impact does CVE-2015-4645 have on affected software?
CVE-2015-4645 can cause a stack-based buffer overflow, leading to application crashes and potential denial of service.
Which versions of Squashfs are affected by CVE-2015-4645?
CVE-2015-4645 affects Squashfs versions up to and including 4.3.
Is CVE-2015-4645 a remote vulnerability?
Yes, CVE-2015-4645 allows remote attackers to exploit the vulnerability through crafted input.