CVE-2012-4024

Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.

• CWE-787

• http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-develThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:128Not Applicable
• http://www.openwall.com/lists/oss-security/2012/07/19/6Mailing List
• http://www.osvdb.org/83898Broken Link
• http://www.securityfocus.com/bid/54610Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77106VDB Entry
• https://security.gentoo.org/glsa/201612-40Third Party Advisory
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001Third Party Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-develThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:128Not Applicable
• http://www.openwall.com/lists/oss-security/2012/07/19/6Mailing List
• http://www.osvdb.org/83898Broken Link
• http://www.securityfocus.com/bid/54610Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77106VDB Entry
• https://security.gentoo.org/glsa/201612-40Third Party Advisory
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001Third Party Advisory

Published

Jul 19, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4018Cross-site scripting (XSS) vulnerability in Final Beta Labor…
• CVE-2012-4019Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in…
• CVE-2012-4020MosP kintai kanri before 4.1.0 does not enforce privilege re…
• CVE-2012-4021MosP kintai kanri before 4.1.0 does not properly perform aut…
• CVE-2012-4022Pebble before 2.6.4 allows remote attackers to trigger loss …
• CVE-2012-4023CRLF injection vulnerability in Pebble before 2.6.4 allows r…
• CVE-2012-4025Integer overflow in the queue_init function in unsquashfs.c …
• CVE-2012-4026The Johnson Controls Pegasys P2000 server with software befo…
• CVE-2012-4027Directory traversal vulnerability in Tridium Niagara AX Fram…
• CVE-2012-4028Tridium Niagara AX Framework does not properly store credent…
• CVE-2012-4029Cross-site scripting (XSS) vulnerability in main/dropbox/ind…6.1
• CVE-2012-4030Chamilo before 1.8.8.6 does not adequately handle user suppl…7.5