CVE-2017-11423

The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.

The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.

It was discovered that libmspack incorrectly handled certain malformed CHM files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2017-6419).

It was discovered that libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service (CVE-2017-11423).

These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmspack-devel-0.10.1-1.12 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

• Update to security release 0.99.3 (bsc#1077732)
  • CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
  • CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
  • CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
    • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.
  • CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
  • CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
  • CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
  • CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
    • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
  • CVE-2017-6420 (bsc#1052448)
    • this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
  • CVE-2017-6419 (bsc#1052449)
    • ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
  • CVE-2017-11423 (bsc#1049423)
    • ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
  • CVE-2017-6418 (bsc#1052466)
    • ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

This update for clamav fixes the following issues:

• Update to security release 0.99.3 (bsc#1077732)

  • CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
  • CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
  • CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
    • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.
  • CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
  • CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
  • CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
  • CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
    • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
  • CVE-2017-6420 (bsc#1052448)
    • this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
  • CVE-2017-6419 (bsc#1052449)
    • ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
  • CVE-2017-11423 (bsc#1049423)
    • ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
  • CVE-2017-6418 (bsc#1052466)
    • ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

• update upstream keys in the keyring

• provide and obsolete clamav-nodb to trigger it's removal in Leap bsc#1040662

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

It was discovered that libmspack incorrectly handled certain malformed CHM files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-6419)

It was discovered that libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2017-6419)

Jakub Wilk discovered that libmspack did not correctly handle certain integer operations and bounds checking. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-4467, CVE-2015-4468, CVE-2015-4469, CVE-2015-4472)

It was discovered that libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2017-11423)

It was discovered that libmspack incorrectly handled certain malformed CHM files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-6419)

Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14679, CVE-2018-14680)

Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14681)

Dmitry Glavatskikh discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-14682)

It was discovered libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2018-18585)

It was discovered that libmspack incorrectly handled certain CHM files. A remote attacker could possibly use this issue to access sensitive information. (CVE-2019-1010305)