CVE-2018-14679

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service (CVE-2018-14679, CVE-2018-14680).

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code (CVE-2018-14681).

Dmitry Glavatskikh discovered that libmspack incorrectly certain CHM files. An attacker could possibly use this issue to execute arbitrary code (CVE-2018-14682).

If a CAB file has a Quantum-compressed datablock with exactly 38912 compressed bytes, cabextract would write exactly one byte beyond its input buffer (CVE-2018-18584).

libmspack didn't reject blank CHM filenames that are blank because they have embedded null bytes, not just because they are zero-length (CVE-2018-18585).

chmextract didn't protect from absolute/relative pathnames in CHM files (CVE-2018-18586).

This update for libmspack fixes the following issues:

• CVE-2018-14681: Bad KWAJ file header extensions could cause a one or two byte overwrite. (bsc#1103032)
• CVE-2018-14682: There is an off-by-one error in the TOLOWER() macro for CHM decompression. (bsc#1103032)
• CVE-2018-14679: There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service. (bsc#1103032)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libmspack fixes the following issues:

• CVE-2018-14681: Bad KWAJ file header extensions could cause a one or two byte overwrite. (bsc#1103032)
• CVE-2018-14682: There is an off-by-one error in the TOLOWER() macro for CHM decompression. (bsc#1103032)
• CVE-2018-14679: There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service. (bsc#1103032)

These are all security issues fixed in the libmspack-devel-0.10.1-1.12 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the clamav-1.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for clamav to version 0.100.1 fixes the following issues:

The following security vulnerabilities were addressed:

• CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410)
• CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412)
• CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858)
• CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040)
• Buffer over-read in unRAR code due to missing max value checks in table initialization
• PDF parser bugs

The following other changes were made:

• Disable YARA support for licensing reasons (bsc#1101654).
• Add HTTPS support for clamsubmit
• Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only

This update for clamav to version 0.100.1 fixes the following issues:

The following security vulnerabilities were addressed:

• CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410)
• CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412)
• CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858)
• CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040)
• Buffer over-read in unRAR code due to missing max value checks in table initialization
• PDF parser bugs

The following other changes were made:

• Disable YARA support for licensing reasons (bsc#1101654).
• Add HTTPS support for clamsubmit
• Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only

This update for clamav fixes the following issues:

• CVE-2018-14679: Fixed off-by-one issue in embedded libmspack that could lead to denial of service (bsc#1103032).

• Update to 0.103.4 (bsc#1192346).

• Add documentation about max file size purpose and side effect in the 'clamscan' and 'clamdscan' manpages (bsc#1187509).

• Update to 0.103.3 (bsc#1188284).

This update for libmspack fixes the following issues:

• CVE-2018-14681: Bad KWAJ file header extensions could cause a one or two byte overwrite. (bsc#1103032)
• CVE-2018-14682: There is an off-by-one error in the TOLOWER() macro for CHM decompression. (bsc#1103032)
• CVE-2018-14679: There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service. (bsc#1103032)

This update for clamav fixes the following issues:

• CVE-2018-14679: Fixed off-by-one issue in embedded libmspack that could lead to denial of service (bsc#1103032).

• Update to 0.103.4 (bsc#1192346).

• Update to 0.103.3 (bsc#1188284).

This update for clamav fixes the following issues:

• CVE-2018-14679: Fixed off-by-one issue in embedded libmspack that could lead to denial of service (bsc#1103032).

• Update to 0.103.4 (bsc#1192346).

• Update to 0.103.3 (bsc#1188284).

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

This update for clamav fixes the following issues:

New version 1.4.2:

• CVE-2025-20128, bsc#1236307: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

• Start clamonacc with --fdpass to avoid errors due to clamd not being able to access user files. (bsc#1232242)

• New version 1.4.1:

  • https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html

• New version 1.4.0:

  • Added support for extracting ALZ archives.
  • Added support for extracting LHA/LZH archives.
  • Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
  • https://blog.clamav.net/2024/08/clamav-140-feature-release-and-clamav.html

• New version 1.3.2:

  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
  • CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
  • Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
  • Fix unit test caused by expiring signing certificate.
  • Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures.
  • Fixed an unaligned pointer dereference issue on select architectures.
  • Fixes to Jenkins CI pipeline.

• New Version: 1.3.1:

  • CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
  • Updated select Rust dependencies to the latest versions.
  • Fixed a bug causing some text to be truncated when converting from UTF-16.
  • Fixed assorted complaints identified by Coverity static analysis.
  • Fixed a bug causing CVDs downloaded by the DatabaseCustomURL
  • Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

• New version: 1.3.0:

  • Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled.
  • Added file type recognition for compiled Python ('.pyc') files.
  • Improved support for decrypting PDFs with empty passwords.
  • Fixed a warning when scanning some HTML files.
  • ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
  • ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.

• New version: 1.2.0:

  • Added support for extracting Universal Disk Format (UDF) partitions.
  • Added an option to customize the size of ClamAV's clean file cache.
  • Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
  • Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.
  • Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
  • PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock .
  • bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature.

• New version 1.1.0:

  • https://blog.clamav.net/2023/05/clamav-110-released.html
  • Added the ability to extract images embedded in HTML CSS

    <style> blocks.

  • Updated to Sigtool so that the '--vba' option will extract VBA code from Microsoft Office documents the same way that …

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14679, CVE-2018-14680)

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14681)

Dmitry Glavatskikh discovered that libmspack incorrectly certain CHM files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14682)

USN-3728-1 fixed several vulnerabilities in libmspack. In Ubuntu 14.04 libmspack is included into ClamAV. This update provides the corresponding update for Ubuntu 14.04 LTS.

Original advisory details:

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14679, CVE-2018-14680)

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14681)

Dmitry Glavatskikh discovered that libmspack incorrectly certain CHM files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14682)

Jakub Wilk discovered that libmspack did not correctly handle certain integer operations and bounds checking. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468, CVE-2015-4469, CVE-2015-4472)

It was discovered that libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2017-11423)

It was discovered that libmspack incorrectly handled certain malformed CHM files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-6419)

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14679, CVE-2018-14680)

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14681)

Dmitry Glavatskikh discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14682)

It was discovered libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2018-18585)

It was discovered that libmspack incorrectly handled certain CHM files. A remote attacker could possibly use this issue to access sensitive information. (CVE-2019-1010305)