FEDORA-2018-cb337fb199 — security update for cabextract and libmspack

stable

cabextract-1.9-1.fc28 and libmspack-0.9.1-0.1.alpha.fc28

FEDORA-2018-cb337fb199 created by rdieter 5 years ago for Fedora 28

Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2018-cb337fb199

This update has been submitted for testing by rdieter.

5 years ago

This update has been pushed to testing.

5 years ago

kparal commented & provided feedback 5 years ago

karma

corrupts extracted cab files. please see #1647033

rdieter commented 5 years ago

This update has been unpushed.

rdieter edited this update.

New build(s):

cabextract-1.9-1.fc28
libmspack-0.9.1-0.1.alpha.fc28

Removed build(s):

cabextract-1.8-1.fc28
libmspack-0.8-0.1.alpha.fc28

Karma has been reset.

5 years ago

This update has been submitted for testing by rdieter.

5 years ago

rdieter edited this update.

5 years ago

This update has been pushed to testing.

5 years ago

filiperosset commented & provided feedback 5 years ago

karma

no regressions noted

kparal commented & provided feedback 5 years ago

karma

seems to fix the corruption bug

BZ#1647033 libmspack-0.8-0.1.alpha corrupts extracted cab files

This update has reached the stable karma threshold and can be pushed to stable now if the maintainer wishes.

5 years ago

This update has been submitted for batched by rdieter.

5 years ago

This update has been submitted for stable by bodhi.

5 years ago

This update has been pushed to stable.

5 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

cabextract-1.9-1.fc28

libmspack-0.9.1-0.1.alpha.fc28

Settings

Unstable by Karma

-4

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

5 years ago

in testing

5 years ago

in stable

5 years ago

modified

5 years ago

BZ#1610896 CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c

BZ#1610897 CVE-2018-14681 libmspack: Out-of-bounds Write in kwajd_read_headers in mspack/kwajd.c [fedora-all]

BZ#1610934 CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks

BZ#1610936 CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks [fedora-all]

BZ#1610941 CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression

BZ#1610942 CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression [fedora-all]

BZ#1644214 CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h

BZ#1644215 CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes

BZ#1644218 CVE-2018-18584 CVE-2018-18585 libmspack: various flaws [fedora-all]

BZ#1644221 CVE-2018-18584 CVE-2018-18585 cabextract: various flaws [fedora-all]

BZ#1647033 libmspack-0.8-0.1.alpha corrupts extracted cab files

cabextract-1.9-1.fc28

libmspack-0.9.1-0.1.alpha.fc28

Automated Test Results

ignored