-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2021.3402
                 USN-5078-3: Squashfs-Tools vulnerability
                              14 October 2021

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Squashfs-Tools
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Overwrite Arbitrary Files -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-41072 CVE-2021-40153 

Reference:         ESB-2021.3120
                   ESB-2021.3111
                   ESB-2021.2994
                   ESB-2021.2935

Original Bulletin: 
   https://ubuntu.com/security/notices/USN-5078-3

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-5078-3: Squashfs-Tools vulnerability
13 October 2021

Squashfs-Tools could be made to overwrite files.
Releases

  o Ubuntu 21.04
  o Ubuntu 20.04 LTS

Packages

  o squashfs-tools - Tools to create and modify squashfs filesystems

Details

USN-5078-1 fixed a vulnerability in Squashfs-Tools. That update was
incomplete and could still result in Squashfs-Tools mishandling certain
malformed SQUASHFS files. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Richard Weinberger discovered that Squashfs-Tools mishandled certain
malformed SQUASHFS files. An attacker could use this vulnerability to
write arbitrary files to the filesystem.

Update instructions

The problem can be corrected by updating your system to the following package
versions:

Ubuntu 21.04

  o squashfs-tools - 1:4.4-2ubuntu0.3

Ubuntu 20.04

  o squashfs-tools - 1:4.4-1ubuntu0.3

In general, a standard system update will make all the necessary changes.

References

  o CVE-2021-41072

Related notices

  o USN-5078-1 : squashfs-tools
  o USN-5078-2 : squashfs-tools

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYWexHeNLKJtyKPYoAQgDnA//Uc1a+xQgwSYW6ChC1IRpYzAO6xXPns3C
VBPNHEZpi0Lhv8OgMw8I+Mxf/iEEwHj8gtE/u4O/dqleEJEZt2Uoq/V+lh/FUFzZ
YblDKk4J9YAbwzHs3PwHzW7uvZMtB5gYGJmy7Prn3xh5ZP1k8M8xqj0vwGURcOCN
vBSS8VpseCqG43VlCI9vFcwc/BCyoD1527fcvsn9iy1mhEz1DezFOQKVpswpCJhF
zlA7JMihraghDHLtjeC5NtTXvoSJHt8y3wWbA5tptZZaDvmjDvWwDpr0aNZDuweS
iN5qrpKrn15V+MyABFezjwu8BU9itDCKvw+OXcbUR0qtWue9G82pHiu9uXnODQGc
0HpBX2iZQwxxP99PPTsuX3KFEQzro5tTazpWhg5rY6FCZpS3eGZBJnxMgCgFutyJ
xkZxAPA83CPG42dwoSgUPjT+zVToB3EpPBZ8EeWErDmViPClaVwmbJvQcrE2TtDP
HAyhLnEg2LRMEwW1KF2u70ShZyJZ3HX/SxrxX72zJuRhoun+W5BT5L34T2SB7cMV
KdBiuBbhIctpoEpJQG/KvV8bpfHieINjy6tCS7A1UwGl3m4BI6jQpevBhrDUp2X0
yvwncYxPmnqcSmbLuUFa2DwScT8K4fZ9vIO+3C54QEu+V4YJ/A+pyEpEW3BvhhhY
H6pl6+GinCU=
=Tw0H
-----END PGP SIGNATURE-----