CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 1CVE-2019-1010305 – libmspack: buffer overflow in function chmd_read_headers()
https://notcve.org/view.php?id=CVE-2019-1010305
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d. libmspack versión 0.9.1alpha se ve afectado por: Desbordamiento de búfer. • https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d https://github.com/kyz/libmspack/issues/27 https://lists.debian.org/debian-lts-announce/2019/08/msg00028.html https://lists.debian.org/debian-lts-announce/2021/10/msg00033.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXWNEY4CJBLPRKV6LG7FQUPD6WVZYBTB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2QJTUAGP22YY7453MHGTFN4YQE5HJBR https://usn.ubuntu.com • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2018-18586
https://notcve.org/view.php?id=CVE-2018-18586
chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application ** EN DISPUTA ** chmextract.c en el programa de muestra chmextract, tal y como se distribuye en libmspack en versiones anteriores a la 0.8alpha, no protege contra nombres de ruta absoluta/relativa en archivos CHM, lo que conduce a un salto de directorio. NOTA: el fabricante discute que esto sea una vulnerabilidad en libmspack, ya que chmextract.c solo se diseñó como ejemplo de código abierto, no una aplicación soportada. • https://bugs.debian.org/911639 https://github.com/kyz/libmspack/commit/7cadd489698be117c47efcadd742651594429e6d https://security.gentoo.org/glsa/201903-20 https://www.openwall.com/lists/oss-security/2018/10/22/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 19EXPL: 1CVE-2018-18585 – libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes
https://notcve.org/view.php?id=CVE-2018-18585
chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name). chmd_read_headers en mspack/chmd.c en libmspack en versiones anteriores a la 0.8alpha acepta un nombre de archivo que tiene "\0" como su primer o segundo carácter (como el nombre "/\0"). • https://access.redhat.com/errata/RHSA-2019:2049 https://bugs.debian.org/911637 https://github.com/kyz/libmspack/commit/8759da8db6ec9e866cb8eb143313f397f925bb4f https://lists.debian.org/debian-lts-announce/2018/10/msg00017.html https://security.gentoo.org/glsa/201903-20 https://usn.ubuntu.com/3814-1 https://usn.ubuntu.com/3814-2 https://usn.ubuntu.com/3814-3 https://www.openwall.com/lists/oss-security/2018/10/22/1 https://www.starwindsoftware.com/security/sw-20181213-0002 • CWE-476: NULL Pointer Dereference •