Out-of-bounds read in libmspack - CVE-2019-1010305

Vulnerability identifier: #VU19266

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1010305

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing a specially crafted chm file in libmspack 0.9.1alpha. A remote attacker can create a specially crafted chm file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

libmspack
libmspack (Red Hat package)
libmspack (Alpine package)
libmspack
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora

Install update from vendor's website.

libmspack - update to 1.9.1
libmspack (Red Hat package) - addressed in versions 0.5-0.8.alpha.el7, 0.7-0.3.alpha.el8.4
libmspack (Alpine package) - update to 0.8_alpha-r1
libmspack - addressed in versions 0.10.1-0.1.alpha.fc29, 0.10.1-0.1.alpha.fc30

• https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d
• https://github.com/kyz/libmspack/issues/27
• https://usn.ubuntu.com/4066-1/

• Information disclosure in libmspack
• Red Hat Enterprise Linux 8 update for libmspack
• OpenSUSE Linux update for libmspack
• Out-of-bounds read in libmspack (Alpine package)
• Red Hat Enterprise Linux 7 update for libmspack
• Fedora 30 update for libmspack
• Fedora 29 update for libmspack