Low: libmspack security and bug fix update
Summary
ALSA-2020:1686: Low: libmspack security and bug fix update. Affects libmspack versions < 0.7-0.3.alpha.el8.4. Fixed in 0.7-0.3.alpha.el8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libmspack packages contain a library providing compression and extraction of the Cabinet (CAB) file format used by Microsoft. It is commonly used in various software applications to handle CAB files. The library offers functionality for compressing and decompressing files in the CAB format, as well as extracting their contents. This vulnerability affects the libmspack package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in libmspack is a buffer overflow issue that exists in the chmd_read_headers() function. This vulnerability is identified as CVE-2019-1010305. An attacker can exploit this vulnerability by providing a specially crafted CAB file, which can lead to arbitrary code execution or a denial of service condition. The impact of this vulnerability can be severe, as it allows an attacker to gain unauthorized access to the system or cause the application to crash. The CVSS score and other related information can be found in the CVE page linked in the References section.
How To Fix
Minimum fixed version
0.7-0.3.alpha.el8.4
This is the first release that contains the fix.
sudo dnf update libmspackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libmspack package in AlmaLinux 8 is affected by a buffer overflow vulnerability (CVE-2019-1010305) in the chmd_read_headers() function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service condition. To mitigate this vulnerability, it is recommended to update the libmspack package to version 0.7-0.3.alpha.el8.4 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libmspack →
FAQ
libmspack is a library used for compression and extraction of the Cabinet (CAB) file format. It is commonly used in software applications to handle CAB files.
The vulnerability allows an attacker to execute arbitrary code or cause a denial of service condition. This can lead to unauthorized access or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the libmspack package to the latest version.
You can find more information about this vulnerability, including the CVE page and AlmaLinux Release Notes, in the References section of the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for libmspack.
