Description
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
References (13)
Core 13
Core References
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3728-3/
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2018/dsa-4260
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html
Issue Tracking, Mailing List, Patch, Third Party Advisory x_refsource_misc
https://bugs.debian.org/904799
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2018/07/26/1
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3789-2/
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3728-2/
Patch, Third Party Advisory x_refsource_misc
https://github.com/kyz/libmspack/commit/0b0ef9344255ff5acfac6b7af09198ac9c9756c8
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1041410
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/3728-1/
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3327
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201903-20
Scores
CVSS v3
8.8
EPSS
0.0443
EPSS Percentile
89.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (16)
cabextract/libmspack
0.0.20060920 alpha
cabextract/libmspack
0.3 alpha
cabextract/libmspack
0.4 alpha
cabextract/libmspack
0.5 alpha
cabextract/libmspack
0.6 alpha
cabextract_project/cabextract
< 1.5
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.04
... and 6 more
Published
Jul 28, 2018
Tracked Since
Feb 18, 2026