Buffer Over-read Vulnerability in libmspack: Denial of Service Risk
Summary
UBUNTU-CVE-2015-4469: The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file. Affects libmspack versions 0.4-1 – 0.4-1ubuntu0.1~esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libmspack is a library designed for handling Microsoft compressed help files (CHM). It provides developers with the ability to read and extract content from CHM files, which are commonly used for documentation and help files in Windows applications. The library is widely used in various applications that require CHM file support. However, prior to version 0.5, libmspack is vulnerable to a buffer over-read issue that can lead to application crashes when processing malicious CHM files.
Vulnerability Detail
The vulnerability, identified as CVE-2015-4469, originates from the chmd_read_headers function in chmd.c within libmspack versions before 0.5. This function fails to validate the lengths of names in CHM files, allowing remote attackers to craft malicious files that exploit this oversight. The result is a denial of service, where the application may crash due to buffer over-reads, leading to potential disruption of service and user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted CHM files until the package is updated. Additionally, consider using alternative file formats or libraries that do not exhibit this vulnerability.
Conclusion
The buffer over-read vulnerability in libmspack poses a significant risk of denial of service through crafted CHM files. Users are strongly advised to update to the latest version of the library to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libmspack →
FAQ
CVE-2015-4469 is a vulnerability in libmspack that allows remote attackers to cause a denial of service through crafted CHM files.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failing to fix this vulnerability may lead to application crashes and denial of service, impacting user experience and potentially exposing sensitive data.
Yes, a patched version of libmspack is available. Users should update to version 0.5 or later to mitigate the risk.
If immediate updates are not possible, avoid using untrusted CHM files and consider alternative libraries or formats until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libmspack.
