SUSE-SU-2016:0011-1

CVE-2014-9732: The cabd_extract function in cabd.c in libmspack did not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive (bnc#934524).
CVE-2015-4467: The chmd_init_decomp function in chmd.c in libmspack did not properly validate the reset interval, which allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file (bnc#934525).
CVE-2015-4468: Multiple integer overflows in the search_chunk function in chmd.c in libmspack allowed remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file (bnc#934526).
CVE-2015-4469: The chmd_read_headers function in chmd.c in libmspack did not validate name lengths, which allowed remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file (bnc#934526).
CVE-2015-4470: Off-by-one error in the inflate function in mszipd.c in libmspack allowed remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CAB archive (bnc#934527).
CVE-2015-4471: Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack allowed remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive (bnc#934528).
CVE-2015-4472: Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file (bnc#934529).

References

Affected packages

SUSE:Linux Enterprise Desktop 12

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Desktop%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Desktop 12 SP1

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Server 12

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Server%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Server 12 SP1

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Server for SAP Applications 12

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Server for SAP Applications 12 SP1

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack0": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Software Development Kit 12

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack-devel": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"

SUSE:Linux Enterprise Software Development Kit 12 SP1

libmspack

Package

Name: libmspack
Purl: pkg:rpm/suse/libmspack&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4-14.4

Ecosystem specific

{
    "binaries": [
        {
            "libmspack-devel": "0.4-14.4"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:0011-1.json"