https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-4646.htmlhttps://patchthecve.com/cve/CVE-2015-4646.htmlWed, 17 Jun 2026 00:27:39 +0000HIGH 7.5: (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.https://patchthecve.com/cve/CVE-2015-4645.htmlhttps://patchthecve.com/cve/CVE-2015-4645.htmlWed, 17 Jun 2026 00:27:39 +0000MEDIUM 5.5: Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.https://patchthecve.com/cve/CVE-2012-4025.htmlhttps://patchthecve.com/cve/CVE-2012-4025.htmlTue, 16 Jun 2026 23:44:17 +0000MEDIUM 6.8: Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.https://patchthecve.com/cve/CVE-2012-4024.htmlhttps://patchthecve.com/cve/CVE-2012-4024.htmlTue, 16 Jun 2026 23:44:17 +0000MEDIUM 6.8: Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constr