Bugzilla – Bug 1201974
VUL-0: CVE-2021-41556: squirrel: Out-of-bounds read
Last modified: 2024-05-24 10:41:11 UTC
CVE-2021-41556 sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41556 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41556 https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4dd1a0dcf9b0bd98 http://www.squirrel-lang.org/#download https://blog.sonarsource.com/squirrel-vm-sandbox-escape/
Affected: - openSUSE:Backports:SLE-15-SP3/squirrel 3.0.7 - openSUSE:Backports:SLE-15-SP4/squirrel 3.0.7 - openSUSE:Factory/squirrel 3.0.7
This is an autogenerated message for OBS integration: This bug (1201974) was mentioned in https://build.opensuse.org/request/show/1058212 Factory / squirrel
Wolfgang, can you please copy the Factory package to the Backport repositories mentioned by Hu in comment#1 ? That should fix the problem for PackageHub.
I created two maintenance requests for updating squirrel in openSUSE:Backports:SLE-15-SP3:Update and openSUSE:Backports:SLE-15-SP4:Update It was already updated in openSUSE:Backports:SLE-15-SP5
This is an autogenerated message for OBS integration: This bug (1201974) was mentioned in https://build.opensuse.org/request/show/1072379 Backports:SLE-15-SP4 / squirrel
Just to repeat what I wrote in the submit request for SP4... Looks like upstream doesn't really care much about ABI stability between versions here. Since this package includes a -devel package, the patch probably should be backported for SP4, as it looks simple enough. The ABI changes here should include SONAME change (SOVER increase) since old code will just *not* run with the new library. The following is a small sample looking at the header diff from the -devel subpackage < SQUIRREL_API SQRESULT sq_getclosureinfo(HSQUIRRELVM v,SQInteger idx,SQUnsignedInteger *nparams,SQUnsignedInteger *nfreevars); --- > SQUIRREL_API SQRESULT sq_getclosureinfo(HSQUIRRELVM v,SQInteger idx,SQInteger *nparams,SQInteger *nfreevars);
SP4 backport fix submitted in https://build.opensuse.org/request/show/1073131
openSUSE-SU-2023:0080-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1201974 CVE References: CVE-2021-41556 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): squirrel-3.0.7-bp154.3.3.1
Closing bug.