CWE
125
Advisory Published
Updated

CVE-2021-41556

First published: Thu Jul 28 2022(Updated: )

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Squirrel-lang Squirrel<=2.2.5
Squirrel-lang Squirrel>=3.0<=3.1
Fedoraproject Fedora=35
Fedoraproject Fedora=36

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2021-41556?

    CVE-2021-41556 is a vulnerability in Squirrel through 2.2.5 and 3.x through 3.1 that allows an out-of-bounds read in the core interpreter, leading to potential code execution.

  • What is the severity of CVE-2021-41556?

    CVE-2021-41556 has a severity value of 10, which is classified as critical.

  • Which software versions are affected by CVE-2021-41556?

    Squirrel versions 2.2.5 and 3.x through 3.1 are affected by CVE-2021-41556.

  • How can an attacker exploit CVE-2021-41556?

    An attacker can exploit CVE-2021-41556 by executing a squirrel script under their control and breaking out of the squirrel script sandbox.

  • How can I fix CVE-2021-41556?

    To fix CVE-2021-41556, it is recommended to update Squirrel to a patched version. Check the official Squirrel-lang website for available downloads and apply the necessary updates.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203