1. CVE-Search
  2. CVE-2018-14682
ID CVE-2018-14682
Summary An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
References
Vulnerable Configurations
  • cpe:2.3:a:cabextract:libmspack:0.6:alpha:*:*:*:*:*:*
    cpe:2.3:a:cabextract:libmspack:0.6:alpha:*:*:*:*:*:*
  • cpe:2.3:a:cabextract:libmspack:0.5:alpha:*:*:*:*:*:*
    cpe:2.3:a:cabextract:libmspack:0.5:alpha:*:*:*:*:*:*
  • cpe:2.3:a:cabextract:libmspack:0.4:alpha:*:*:*:*:*:*
    cpe:2.3:a:cabextract:libmspack:0.4:alpha:*:*:*:*:*:*
  • cpe:2.3:a:cabextract:libmspack:0.0.20060920:alpha:*:*:*:*:*:*
    cpe:2.3:a:cabextract:libmspack:0.0.20060920:alpha:*:*:*:*:*:*
  • cpe:2.3:a:cabextract:libmspack:0.3:alpha:*:*:*:*:*:*
    cpe:2.3:a:cabextract:libmspack:0.3:alpha:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.1:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.3:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.4:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.5:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:cabextract_project:cabextract:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:cabextract_project:cabextract:1.5:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 26-04-2021 - 11:45)
Impact:
Exploitability:
CWE CWE-193
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • bugzilla
    id 1610941
    title CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment libmspack is earlier than 0:0.5-0.6.alpha.el7
            oval oval:com.redhat.rhsa:tst:20183327001
          • comment libmspack is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20183327002
        • AND
          • comment libmspack-devel is earlier than 0:0.5-0.6.alpha.el7
            oval oval:com.redhat.rhsa:tst:20183327003
          • comment libmspack-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20183327004
    rhsa
    id RHSA-2018:3327
    released 2018-10-30
    severity Low
    title RHSA-2018:3327: libmspack security update (Low)
  • rhsa
    id RHSA-2018:3505
rpms
  • libmspack-0:0.5-0.6.alpha.el7
  • libmspack-debuginfo-0:0.5-0.6.alpha.el7
  • libmspack-devel-0:0.5-0.6.alpha.el7
refmap via4
debian DSA-4260
gentoo GLSA-201903-20
misc
mlist [debian-lts-announce] 20180806 [SECURITY] [DLA-1460-1] libmspack security update
sectrack 1041410
ubuntu
  • USN-3728-1
  • USN-3728-2
  • USN-3728-3
  • USN-3789-2
Last major update 26-04-2021 - 11:45
Published 28-07-2018 - 23:29
Last modified 26-04-2021 - 11:45
Back to Top