Published: 18/07/2017 Updated: 03/10/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote malicious users to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libmspack_project libmspack 0.5

Several security issues were fixed in libmspack ...

Debian Bug report logs - #868956 libmspack: CVE-2017-11423 Package: src:libmspack; Maintainer for src:libmspack is Marc Dequènes (Duck) <Duck@DuckCorporg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 19 Jul 2017 20:18:03 UTC Severity: grave Tags: security, upstream Found in version libmspack/0 ...

Debian Bug report logs - #871263 libmspack: CVE-2017-6419 Package: src:libmspack; Maintainer for src:libmspack is Marc Dequènes (Duck) <Duck@DuckCorporg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 7 Aug 2017 13:24:01 UTC Severity: grave Tags: security, upstream Found in version libmspack/0 ...

Heap-based buffer overflow in mspack/lzxdcmspack/lzxdc in libmspack 05alpha, as used in ClamAV 0992, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file (CVE-2017-6419) Out-of-bounds access in the PDF parser (CVE-2018-0202) A V ...

The cabd_read_string function in mspack/cabdc in libmspack 05alpha, as used in ClamAV 0992 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file ...

The cabd_read_string function in mspack/cabdc in libmspack 05alpha, as used in ClamAV before 0994 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file ...

CWE-125 https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul https://bugzilla.clamav.net/show_bug.cgi?id=11873 http://www.debian.org/security/2017/dsa-3946 https://lists.debian.org/debian-lts-announce/2018/02/msg00014.html https://security.gentoo.org/glsa/201804-16 https://usn.ubuntu.com/3394-1/https://nvd.nist.gov

CVE-2017-11423

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect