CVE-2012-4025

Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.

• CWE-190

• http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-develThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:128Not Applicable
• http://www.openwall.com/lists/oss-security/2012/07/19/6Mailing List
• http://www.osvdb.org/83899Broken Link
• http://www.securityfocus.com/bid/54610Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201612-40Third Party Advisory
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001Third Party Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-develThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:128Not Applicable
• http://www.openwall.com/lists/oss-security/2012/07/19/6Mailing List
• http://www.osvdb.org/83899Broken Link
• http://www.securityfocus.com/bid/54610Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201612-40Third Party Advisory
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0001Third Party Advisory

Published

Jul 19, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4019Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in…
• CVE-2012-4020MosP kintai kanri before 4.1.0 does not enforce privilege re…
• CVE-2012-4021MosP kintai kanri before 4.1.0 does not properly perform aut…
• CVE-2012-4022Pebble before 2.6.4 allows remote attackers to trigger loss …
• CVE-2012-4023CRLF injection vulnerability in Pebble before 2.6.4 allows r…
• CVE-2012-4024Stack-based buffer overflow in the get_component function in…
• CVE-2012-4026The Johnson Controls Pegasys P2000 server with software befo…
• CVE-2012-4027Directory traversal vulnerability in Tridium Niagara AX Fram…
• CVE-2012-4028Tridium Niagara AX Framework does not properly store credent…
• CVE-2012-4029Cross-site scripting (XSS) vulnerability in main/dropbox/ind…6.1
• CVE-2012-4030Chamilo before 1.8.8.6 does not adequately handle user suppl…7.5
• CVE-2012-4031Multiple directory traversal vulnerabilities in src/acloglog…