# Security update for squashfs

Announcement ID: SUSE-SU-2024:2463-1  
Rating: important  
References:

  * bsc#1189936
  * bsc#1190531
  * bsc#935380

  
Cross-References:

  * CVE-2015-4645
  * CVE-2015-4646
  * CVE-2021-40153
  * CVE-2021-41072

  
CVSS scores:

  * CVE-2015-4645 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2015-4645 ( NVD ):  5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2015-4646 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2021-40153 ( SUSE ):  6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
  * CVE-2021-40153 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
  * CVE-2021-41072 ( SUSE ):  6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
  * CVE-2021-41072 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

  
Affected Products:

  * SUSE Linux Enterprise Micro 5.5

  
  
An update that solves four vulnerabilities can now be installed.

## Description:

This update for squashfs fixes the following issues:

  * CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-
    tools (bsc#935380)
  * CVE-2021-40153: Fixed an issue where an attacker might have been able to
    write a file outside of destination (bsc#1189936)
  * CVE-2021-41072: Fixed an issue where an attacker might have been able to
    write a file outside the destination directory via a symlink (bsc#1190531).

update to 4.6.1:

  * Race condition which can cause corruption of the "fragment table" fixed.
    This is a regression introduced in August 2022, and it has been seen when
    tailend packing is used (-tailends option).
  * Fix build failure when the tools are being built without extended attribute
    (XATTRs) support.
  * Fix XATTR error message when an unrecognised prefix is found
  * Fix incorrect free of pointer when an unrecognised XATTR prefix is found.
  * Major improvements in extended attribute handling, pseudo file handling, and
    miscellaneous new options and improvements
  * Extended attribute handling improved in Mksquashfs and Sqfstar
  * New Pseudo file xattr definition to add extended attributes to files.
  * New xattrs-add Action to add extended attributes to files
  * Extended attribute handling improved in Unsquashfs
  * Other major improvements
  * Unsquashfs can now output Pseudo files to standard out.
  * Mksquashfs can now input Pseudo files from standard in.
  * Squashfs filesystems can now be converted (different block size compression
    etc) without unpacking to an intermediate filesystem or mounting, by piping
    the output of Unsquashfs to Mksquashfs.
  * Pseudo files are now supported by Sqfstar.
  * "Non-anchored" excludes are now supported by Unsquashfs.

update to 4.5.1 (bsc#1190531, CVE-2021-41072):

  * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and
    Sqfscat(1).
  * The -help text output from the utilities has been improved and extended as
    well (but the Manpages are now more comprehensive).
  * CVE-2021-41072 which is a writing outside of destination exploit, has been
    fixed.
  * The number of hard-links in the filesystem is now also displayed by
    Mksquashfs in the output summary.
  * The number of hard-links written by Unsquashfs is now also displayed in the
    output summary.
  * Unsquashfs will now write to a pre-existing destination directory, rather
    than aborting.
  * Unsquashfs now allows "." to used as the destination, to extract to the
    current directory.
  * The Unsquashfs progress bar now tracks empty files and hardlinks, in
    addition to data blocks.
  * -no-hardlinks option has been implemented for Sqfstar.
  * More sanity checking for "corrupted" filesystems, including checks for
    multiply linked directories and directory loops.
  * Options that may cause filesystems to be unmountable have been moved into a
    new "experts" category in the Mksquashfs help text (and Manpage).
  * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to
    overflow the stack, or cause system calls to fail with a too long pathname.
  * Don't always use "max open file limit" when calculating length of queues, as
    a very large file limit can cause Unsquashfs to abort. Instead use the
    smaller of max open file limit and cache size.
  * Fix Mksquashfs silently ignoring Pseudo file definitions when appending.
  * Don't abort if no XATTR support has been built in, and there's XATTRs in the
    filesystem. This is a regression introduced in 2019 in Version 4.4.
  * Fix duplicate check when the last file block is sparse.

update to 4.5:

  * Mksquashfs now supports "Actions".
  * New sqfstar command which will create a Squashfs image from a tar archive.
  * Tar style handling of source pathnames in Mksquashfs.
  * Cpio style handling of source pathnames in Mksquashfs.
  * New option to throttle the amount of CPU and I/O.
  * Mksquashfs now allows no source directory to be specified.
  * New Pseudo file "R" definition which allows a Regular file o be created with
    data stored within the Pseudo file.
  * Symbolic links are now followed in extract files
  * Unsquashfs now supports "exclude" files.
  * Max depth traversal option added.
  * Unsquashfs can now output a "Pseudo file" representing the input Squashfs
    filesystem.
  * New -one-file-system option in Mksquashfs.
  * New -no-hardlinks option in Mksquashfs.
  * Exit code in Unsquashfs changed to distinguish between non-fatal errors
    (exit 2), and fatal errors (exit 1).
  * Xattr id count added in Unsquashfs "-stat" output.
  * Unsquashfs "write outside directory" exploit fixed.
  * Error handling in Unsquashfs writer thread fixed.
  * Fix failure to truncate destination if appending aborted.
  * Prevent Mksquashfs reading the destination file.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Micro 5.5  
    zypper in -t patch SUSE-SLE-Micro-5.5-2024-2463=1

## Package List:

  * SUSE Linux Enterprise Micro 5.5 (ppc64le)
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1

## References:

  * https://www.suse.com/security/cve/CVE-2015-4645.html
  * https://www.suse.com/security/cve/CVE-2015-4646.html
  * https://www.suse.com/security/cve/CVE-2021-40153.html
  * https://www.suse.com/security/cve/CVE-2021-41072.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1189936
  * https://bugzilla.suse.com/show_bug.cgi?id=1190531
  * https://bugzilla.suse.com/show_bug.cgi?id=935380