CVE:CVE-2021-40153
CNNVD:CNNVD-202108-2648
squashfs-tools是一个开源软件包。
Squashfs-Tools 4.5版本存在安全漏洞，该漏洞源于在软件中的unsquash-1.c中的squashfs_opendir函数负责存储目录条目中的文件名，然后unsquashfs使用它在unsquash期间创建新文件。函数文件名操作对于目标目录外的遍历并不进行验证，因此文件名被允许写入到目标目录外的位置。
solution:Upgrade squashfs-tools_project squashfs-tools to a higher version than 4.5,and avoid the version 4.5; Upgrade fedoraproject fedora to a higher version than 34,33,and avoid the version 34,33; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade redhat enterprise_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0