CVE-2018-14680

MEDIUM

libmspack <0.7alpha - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

References (13)

Core 13
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3728-3/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4260
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html
Issue Tracking, Mailing List, Patch, Third Party Advisory x_refsource_misc
https://bugs.debian.org/904801
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2018/07/26/1
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3789-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3728-2/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041410
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3728-1/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3327
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201903-20

Scores

CVSS v3 6.5
EPSS 0.0292
EPSS Percentile 86.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (16)
cabextract/libmspack 0.0.20060920 alpha
cabextract/libmspack 0.3 alpha
cabextract/libmspack 0.4 alpha
cabextract/libmspack 0.5 alpha
cabextract/libmspack 0.6 alpha
cabextract_project/cabextract < 1.5
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
... and 6 more
Published Jul 28, 2018
Tracked Since Feb 18, 2026