CVE-2021-41556

Name	CVE-2021-41556
Description	sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1016212

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squirrel3 (PTS)	stretch	3.1-4	vulnerable
	buster	3.1-7	vulnerable
	bullseye	3.1-8	vulnerable
	sid, trixie	3.1-8.2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
squirrel3	source	stretch	(unfixed)	end-of-life
squirrel3	source	(unstable)	(unfixed)			1016212

Notes

[bullseye] - squirrel3 <no-dsa> (Minor issue)
[buster] - squirrel3 <no-dsa> (Minor issue)
https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4dd1a0dcf9b0bd98 (v3.2)
https://blog.sonarsource.com/squirrel-vm-sandbox-escape/