Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

SUSE: 2020:2711-1 Moderate: Libmspack Buffer Overflow Fix

suse
Calendar Grey September 22, 2020
Dist Suse Esm H88
SUSE Security Patch resolves various vulnerabilities in libmspack, featuring serious buffer overflow and sensitive data leakage problems.
An update that solves three vulnerabilities and has one errata is now available

Summary

This update for libmspack fixes the following issues: Security issues fixed: - CVE-2019-1010305: Fixed a buffer overflow triggered by a crafted chm file which could have led to information disclosure (bsc#1141680). - CVE-2018-18584: The CAB block input buffer was one byte too small for the maximal Quantum block, leading to an out-of-bounds write. (bsc#1113038) - CVE-2018-18585: chmd_read_headers accepted a filename that has '\0' as its first or second character (such as the "/\0" name). (bsc#1113039) - Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and reject empty filenames. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:

References

#1113038 #1113039 #1130489 #1141680

Cross- CVE-2018-18584 CVE-2018-18585 CVE-2019-1010305

Affected Products:

SUSE Linux Enterprise Software Development Kit 12-SP5

SUSE Linux Enterprise Server 12-SP5

https://www.suse.com/security/cve/CVE-2018-18584.html

https://www.suse.com/security/cve/CVE-2018-18585.html

https://www.suse.com/security/cve/CVE-2019-1010305.html

https://bugzilla.suse.com/1113038

https://bugzilla.suse.com/1113039

https://bugzilla.suse.com/1130489

https://bugzilla.suse.com/1141680

Announcement ID: SUSE-SU-2020:2711-1
Rating: moderate

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here