Red Hat Security AdvisoryRHSA-2019:2049
libmspack security update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libmspack-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libmspack-devel-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libmspack-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libmspack-devel-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux Server (v. 7) libmspack-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux Server Optional (v. 7) libmspack-0.5-0.7.alpha.el7, libmspack-devel-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux Workstation (v. 7) libmspack-0.5-0.7.alpha.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) libmspack-devel-0.5-0.7.alpha.el7
Fixes 2 records
Priority LOW 34
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02662 · Published 2018-10-23 · Fixed CWE-787
Priority LOW 25
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.02939 · Published 2018-10-23 · Fixed CWE-476
