Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 Feb 2015 16:52:05 +0100
From: Salvatore Bonaccorso <>
To: OSS Security Mailinglist <>
Cc: CVE Assignments MITRE <>
Subject: Possible CVE Requests: libmspack: several issues


Several issues with the libmspack library were reported recently in
the Debian bugtracker by Jakub Wilk. An (older) copy of libmspack is
also embedded in ClamAV (not verified if this version is also affected
by these issues).

The reported bugs are the following:

null pointer dereference on a crafted CAB:

CHM decompression: division by zero

CHM decompression: pointer arithmetic overflow

off-by-one buffer over-read in mspack/mszipd.c

off-by-one buffer under-read in mspack/lzxd.c

CHM decompression: another pointer arithmetic overflow

Could CVEs be assigned for these issues?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.