CVE-2014-9556

Updated cabextract packages fix security vulnerability:

Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556).

These are all security issues fixed in the libmspack-devel-0.5-2.8 package on the GA media of openSUSE Tumbleweed.

libmspack was updated to fix one security issue.

This security issue was fixed:

• Possible DoS by infinite loop (bnc#912214, CVE-2014-9556)

libmspack was updated to fix one security issue.

This security issue was fixed:

• Possible DoS by infinite loop (bnc#912214, CVE-2014-9556)

The previous fix was not fully fixing this problem.

This update fixes the following security issue:

* CVE-2014-9556: An integer overflow in the function qtmd_decompress()
  could have been exploited causing a denial of service (endless loop)
  (bnc##912214)

Security Issues:

* CVE-2014-9556
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556>

This security update fixes the following issues:

• Fix possible infinite loop caused DoS (bsc919283, CVE-2014-9556)
• Fix zero dereference (bsc#934524, CVE-2014-9732)
• Fix off by one (bsc#934527, CVE-2015-4470)
• Fix buffer under-read crash (bsc#934528, CVE-2015-4471)

Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.