{"id":"CVE-2018-18586","aliases":["ALPINE-CVE-2018-18586","DEBIAN-CVE-2018-18586","EUVD-2018-10306","GHSA-jcvf-2rhc-m6h8","MGASA-2018-0455","SUSE-SU-2022:0069-1","SUSE-SU-2022:0069-2","SUSE-SU-2022:4287-1","openSUSE-SU-2022:0069-1","openSUSE-SU-2024:13619-1"],"status":"disputed","title":"** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack...","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03284,"percentile":0.88543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-10-23T02:00:00Z","modified":"2026-10-23T18:02:28Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libmspack","fixed_in":["0.8_alpha-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libmspack","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libmspack","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libmspack","fixed_in":["0.8-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libmspack","fixed_in":["0.6-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libmspack","fixed_in":["0.6-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libmspack","fixed_in":["0.6-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libmspack","fixed_in":["0.6-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libmspack","fixed_in":["0.4-15.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libmspack","fixed_in":["0.4-15.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libmspack","fixed_in":["0.4-15.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libmspack","fixed_in":["0.6-3.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8_alpha-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-0.alpha.1.mga6"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:6","package":"cabextract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-1.mga6"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-15.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-15.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4-15.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libmspack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6-3.14.1"}]}]}],"products":[{"vendor":"kyzer","product":"libmspack"}],"references":[{"url":"https://github.com/kyz/libmspack/commit/7cadd489698be117c47efcadd742651594429e6d","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/22/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://bugs.debian.org/911639","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201903-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18586"},{"url":"https://github.com/advisories/GHSA-jcvf-2rhc-m6h8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-18586","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18586","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0455.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23365","tags":["report"]},{"url":"https://usn.ubuntu.com/3728-1/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/23/11","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220069-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1113040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18586","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220069-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224287-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IRYD4Y2CDUYSBVQUIDXTTBL6H6XYW54G/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010305","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-18586","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"disputed","published":"2018-10-23T02:00:00Z","modified":"2024-08-05T11:15:59.912Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-10306","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"published","published":"2018-10-23T02:00:00Z","modified":"2024-08-05T11:15:59Z","updated_at":"2026-11-03T02:39:35.790696Z"}],"ghsa":[{"id":"GHSA-jcvf-2rhc-m6h8","title":"** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack...","description":"** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.","status":"published","published":"2022-05-14T01:13:39Z","modified":"2023-02-02T05:03:09Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:35.055103Z"}],"nvd":[{"id":"CVE-2018-18586","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"disputed","published":"2018-10-23T02:29:00.7Z","modified":"2026-06-17T01:47:33.16Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:46.409324Z"}],"osv":[{"id":"ALPINE-CVE-2018-18586","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"published","published":"2018-10-23T02:29:00.7Z","modified":"2026-10-23T17:23:45.531601455Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-18586","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"published","published":"2018-10-23T02:29:00.7Z","modified":"2026-10-20T13:20:46.327152921Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18586","description":"chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application","status":"published","published":"2018-10-23T02:29:00.7Z","modified":"2026-10-23T18:02:28.96121123Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"MGASA-2018-0455","title":"Updated libmspack/cabextract packages fix security vulnerabilities","description":"Hanno Böck discovered that libmspack incorrectly handled certain CHM\nfiles. An attacker could possibly use this issue to cause a denial of\nservice (CVE-2018-14679, CVE-2018-14680).\n\nJakub Wilk discovered that libmspack incorrectly handled certain KWAJ\nfiles. An attacker could possibly use this issue to execute arbitrary\ncode (CVE-2018-14681).\n\nDmitry Glavatskikh discovered that libmspack incorrectly certain CHM\nfiles. An attacker could possibly use this issue to execute arbitrary\ncode (CVE-2018-14682).\n\nIf a CAB file has a Quantum-compressed datablock with exactly 38912\ncompressed bytes, cabextract would write exactly one byte beyond its\ninput buffer (CVE-2018-18584).\n\nlibmspack didn't reject blank CHM filenames that are blank because they\nhave embedded null bytes, not just because they are zero-length\n(CVE-2018-18585).\n\nchmextract didn't protect from absolute/relative pathnames in CHM files\n(CVE-2018-18586).\n","status":"published","published":"2018-11-17T22:23:26Z","modified":"2026-04-16T06:25:07.215441631Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2022:0069-1","title":"Security update for libmspack","description":"This update for libmspack fixes the following issues:\n\n- CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).\n","status":"published","published":"2022-01-13T14:12:42Z","modified":"2026-02-04T03:08:25.325629Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13619-1","title":"libmspack-devel-0.11-2.1 on GA media","description":"These are all security issues fixed in the libmspack-devel-0.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:14.920643Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:0069-1","title":"Security update for libmspack","description":"This update for libmspack fixes the following issues:\n\n- CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).\n","status":"published","published":"2022-01-13T14:12:43Z","modified":"2026-02-04T02:35:56.17247Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0069-2","title":"Security update for libmspack","description":"This update for libmspack fixes the following issues:\n\n- CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection (bsc#1113040).\n","status":"published","published":"2022-02-18T08:29:06Z","modified":"2026-02-04T02:42:59.537153Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:4287-1","title":"Security update for libmspack","description":"This update for libmspack fixes the following issues:\n\n- CVE-2018-18586: Add leading slash protection to chmextract. (bsc#1113040)\n","status":"published","published":"2022-11-29T14:58:18Z","modified":"2026-02-04T03:58:11.471709Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}