PatchTheCVElibmspack vulnerabilities and fixes
Recent CVEs affecting libmspack, with upgrade or downgrade steps. 10 tracked.
libmspack has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2019-07-15. Highest priority: CVE-2018-14682 (score 58/100).
- CVE-2019-1010305 MEDIUM 5.5 DOWNGRADE MITIGATE libmspack 0.9.1alpha is affected by: Buffer Overflow
- CVE-2018-18586 MEDIUM 5.3 DOWNGRADE chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect
- CVE-2018-18585 MEDIUM 4.3 DOWNGRADE MITIGATE chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first
- CVE-2018-18584 MEDIUM 6.5 UPGRADE DOWNGRADE In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte
- CVE-2018-14682 HIGH 8.8 DOWNGRADE UPGRADE An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha
- CVE-2018-14681 HIGH 8.8 DOWNGRADE UPGRADE An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha
- CVE-2018-14680 MEDIUM 6.5 DOWNGRADE UPGRADE An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha
- CVE-2018-14679 MEDIUM 6.5 DOWNGRADE UPGRADE An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha
- CVE-2017-6419 HIGH 7.8 DOWNGRADE mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of se
- CVE-2017-11423 MEDIUM 5.5 DOWNGRADE The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other produ
FAQ
How do I fix libmspack vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libmspack being exploited right now?
None of the tracked libmspack CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libmspack CVE should I patch first?
CVE-2018-14682 currently ranks highest (58/100): An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha.