Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.

This security update fixes the following issues :

  - Fix possible infinite loop caused DoS (bsc919283,     CVE-2014-9556)

  - Fix zero dereference (bsc#934524, CVE-2014-9732)

  - Fix off by one (bsc#934527, CVE-2015-4470)

  - Fix buffer under-read crash (bsc#934528, CVE-2015-4471)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

MITRE reports :

Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.

Updated cabextract packages fix security vulnerabilities :

Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556).

A directory traversal issue in cabextract allows writing to locations outside of the current working directory, when extracting a crafted cab file that encodes the filenames in a certain manner (CVE-2015-2060).

This update fixes the following security issue :

  - An integer overflow in the function qtmd_decompress()     could have been exploited causing a denial of service     (endless loop) (bnc##912214). (CVE-2014-9556)

updated to bugfix release 0.5alpha

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes previous security update, which was not considered as complete.

Updated cabextract packages fix security vulnerability :

Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556).

libmspack was updated to fix a possible infinite loop caused DoS (bnc912214, CVE-2014-9556).

ID	Name	Product	Family	Severity
87122	SUSE SLED11 Security Update : cabextract (SUSE-SU-2015:2131-1)	Nessus	SuSE Local Security Checks	medium
83942	FreeBSD : libmspack -- frame_end overflow which could cause infinite loop (cc7548ef-06e1-11e5-8fda-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
82317	Mandriva Linux Security Advisory : cabextract (MDVSA-2015:064)	Nessus	Mandriva Local Security Checks	medium
81878	SuSE 11.3 Security Update : libmspack (SAT Patch Number 10402)	Nessus	SuSE Local Security Checks	medium
81857	Fedora 21 : libmspack-0.5-0.1.alpha.fc21 (2015-3249)	Nessus	Fedora Local Security Checks	medium
81855	Fedora 20 : libmspack-0.5-0.1.alpha.fc20 (2015-3205)	Nessus	Fedora Local Security Checks	medium
81851	Fedora 22 : libmspack-0.5-0.1.alpha.fc22 (2015-3118)	Nessus	Fedora Local Security Checks	medium
81720	openSUSE Security Update : libmspack (openSUSE-2015-208)	Nessus	SuSE Local Security Checks	medium
81282	Mandriva Linux Security Advisory : cabextract (MDVSA-2015:041)	Nessus	Mandriva Local Security Checks	medium
81137	openSUSE Security Update : libmspack (openSUSE-SU-2015:0187-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-9556

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium