CVE Feed

    Dashboard / CVE / CVE-2018-14679

    CVE-2018-14679

    An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

    Published:May 12, 2018
    Last Modified:Nov 21, 2024
    EPS:Jul 28, 2018
    EPSS Score:0.00931
    CVSS Score:6.5

    Affected Products

    Vendor
    Cabextract
    Product
    Libmspack
    Vendor
    Cabextract Project
    Product
    Cabextract
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Redhat
    Product
    Ansible Tower
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Desktop
    Vendor
    Redhat
    Product
    Enterprise Linux Server
    Vendor
    Redhat
    Product
    Enterprise Linux Workstation

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-193 Off-by-one Error

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://www.openwall.com/lists/oss-security/2018/07/26/1
    http://www.securitytracker.com/id/1041410
    https://access.redhat.com/errata/RHSA-2018:3327
    https://access.redhat.com/errata/RHSA-2018:3505
    https://bugs.debian.org/904802
    https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a
    https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html
    https://security.gentoo.org/glsa/201903-20
    https://usn.ubuntu.com/3728-1/
    https://usn.ubuntu.com/3728-2/
    https://usn.ubuntu.com/3728-3/
    https://usn.ubuntu.com/3789-2/
    https://www.debian.org/security/2018/dsa-4260
    http://www.openwall.com/lists/oss-security/2018/07/26/1
    http://www.securitytracker.com/id/1041410
    https://access.redhat.com/errata/RHSA-2018:3327
    https://access.redhat.com/errata/RHSA-2018:3505
    https://bugs.debian.org/904802
    https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a
    https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html
    https://security.gentoo.org/glsa/201903-20
    https://usn.ubuntu.com/3728-1/
    https://usn.ubuntu.com/3728-2/
    https://usn.ubuntu.com/3728-3/
    https://usn.ubuntu.com/3789-2/
    https://www.debian.org/security/2018/dsa-4260

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High