chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4287-1 advisory.

  - ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before     0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory     Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only     intended as a source-code example, not a supported application. (CVE-2018-18586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0069-2 advisory.

  - ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before     0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory     Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only     intended as a source-code example, not a supported application. (CVE-2018-18586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0069-1 advisory.

  - ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before     0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory     Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only     intended as a source-code example, not a supported application. (CVE-2018-18586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0069-1 advisory.

  - ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before     0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory     Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only     intended as a source-code example, not a supported application. (CVE-2018-18586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - chmextract.c in the chmextract sample program, as     distributed with libmspack before 0.8alpha, does not     protect against absolute/relative pathnames in CHM     files, leading to Directory Traversal. NOTE: the vendor     disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** chmextract.c in the chmextract sample     program, as distributed with libmspack before 0.8alpha,     does not protect against absolute/relative pathnames in     CHM files, leading to Directory Traversal. NOTE: the     vendor disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

  - ** DISPUTED ** chmextract.c in the chmextract sample     program, as distributed with libmspack before 0.8alpha,     does not protect against absolute/relative pathnames in     CHM files, leading to Directory Traversal. NOTE: the     vendor disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

  - The cabd_read_string function in mspack/cabd.c in     libmspack 0.5alpha, as used in ClamAV 0.99.2 and other     products, allows remote attackers to cause a denial of     service (stack-based buffer over-read and application     crash) via a crafted CAB file.(CVE-2017-11423)

  - mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV     0.99.2, allows remote attackers to cause a denial of     service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted CHM file.(CVE-2017-6419)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-20 (cabextract, libmspack: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cabextract and       libmspack. Please review the CVE identifiers referenced below for       details.
  Impact :

    Please review the referenced CVE&rsquo;s for details.
  Workaround :

    There is no known workaround at this time.

This update for libmspack fixes the following issues :

Security issues fixed :

  - CVE-2018-18584: The CAB block input buffer was one byte     too small for the maximal Quantum block, leading to an     out-of-bounds write. (bsc#1113038)

  - CVE-2018-18585: chmd_read_headers accepted a filename     that has '\0' as its first or second character (such as     the '/\0' name). (bsc#1113039)

  - CVE-2018-18586: chmextract.c in the chmextract sample     program did not protect against absolute/relative     pathnames in CHM files, leading to Directory Traversal.
    NOTE: the vendor disputes that this is a libmspack     vulnerability, because chmextract.c was only intended as     a source-code example, not a supported application.
    (boo#1113040)

  - Fix off-by-one bounds check on CHM PMGI/PMGL chunk     numbers and reject empty filenames.

ID	Name	Product	Family	Severity
168302	SUSE SLES12 Security Update : libmspack (SUSE-SU-2022:4287-1)	Nessus	SuSE Local Security Checks	medium
158174	SUSE SLES15 Security Update : libmspack (SUSE-SU-2022:0069-2)	Nessus	SuSE Local Security Checks	medium
156747	openSUSE 15 Security Update : libmspack (openSUSE-SU-2022:0069-1)	Nessus	SuSE Local Security Checks	medium
156746	SUSE SLED15 / SLES15 Security Update : libmspack (SUSE-SU-2022:0069-1)	Nessus	SuSE Local Security Checks	medium
153358	EulerOS 2.0 SP2 : libmspack (EulerOS-SA-2021-2398)	Nessus	Huawei Local Security Checks	medium
135532	EulerOS 2.0 SP3 : libmspack (EulerOS-SA-2020-1403)	Nessus	Huawei Local Security Checks	medium
132607	EulerOS 2.0 SP8 : libmspack (EulerOS-SA-2020-1014)	Nessus	Huawei Local Security Checks	medium
131808	EulerOS 2.0 SP5 : libmspack (EulerOS-SA-2019-2534)	Nessus	Huawei Local Security Checks	high
123426	GLSA-201903-20 : cabextract, libmspack: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
118561	openSUSE Security Update : libmspack (openSUSE-2018-1329)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-18586

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

medium