Fedora 29: libmspack Security Update
Summary
The purpose of libmspack is to provide both compression and decompression of
some loosely related file formats used by Microsoft.
Latest stable releases of libmspack and cabextract, includes security fixes for
CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585
* Tue Nov 6 2018 Rex Dieter
- 0.9.1alpha
- libmspack-0.8-0.1.alpha corrupts extracted cab files (#1647033)
- examples no longer installed (by default)
* Tue Oct 30 2018 Rex Dieter
- 0.8alpha
- use %make_build %make_install %ldconfig_scriptlets %license
- devel: use %{?_isa} to tighten dep on main pkg
- drop deprecated Group: tag
- %files: tighten to include library soname
[ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes
https://bugzilla.redhat.com/show_bug.cgi?id=1644215
[ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h
https://bugzilla.redhat.com/show_bug.cgi?id=1644214
[ 3 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c
https://bugzilla.redhat.com/show_bug.cgi?id=1610896
[ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks
https://bugzilla.redhat.com/show_bug.cgi?id=1610934
[ 5 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression
https://bugzilla.redhat.com/show_bug.cgi?id=1610941
su -c 'dnf upgrade --advisory FEDORA-2018-a5953af115' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
FEDORA-2018-a5953af115 2018-11-13 02:18:59.072814 Product : Fedora 29 Version : 0.9.1 Release : 0.1.alpha.fc29 URL : https://www.cabextract.org.uk/libmspack/ Summary : Library for CAB and related files compression and decompression Description : The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft. Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585 * Tue Nov 6 2018 Rex Dieter - 0.9.1-0.1.alpha - 0.9.1alpha - libmspack-0.8-0.1.alpha corrupts extracted cab files (#1647033) - examples no longer installed (by default) * Tue Oct 30 2018 Rex Dieter - 0.8-0.1.alpha - 0.8alpha - use %make_build %make_install %ldconfig_scriptlets %license - devel: use %{?_isa} to tighten dep on main pkg - drop deprecated Group: tag - %files: tighten to include library soname [ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes https://bugzilla.redhat.com/show_bug.cgi?id=1644215 [ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h https://bugzilla.redhat.com/show_bug.cgi?id=1644214 [ 3 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c https://bugzilla.redhat.com/show_bug.cgi?id=1610896 [ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks https://bugzilla.redhat.com/show_bug.cgi?id=1610934 [ 5 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression https://bugzilla.redhat.com/show_bug.cgi?id=1610941 su -c 'dnf upgrade --advisory FEDORA-2018-a5953af115' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Change Log
References