PT-2015-4271 · Microsoft+1 · Libmspack+1

Jakub Wilk · Published 2015-01-30 · Updated 2018-10-30 · CVE-2014-9556

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libmspack version 0.4

Description The issue is caused by an integer overflow in the qtmd decompress function, which allows remote attackers to cause a denial of service via a crafted CAB file. This triggers an infinite loop.

Recommendations For libmspack version 0.4, update to a version that fixes the integer overflow in the qtmd decompress function to prevent remote attackers from causing a denial of service.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2014-9556

MGASA-2015-0052

OPENSUSE-SU-2024:10365-1

SUSE-SU-2015:0366-1

SUSE-SU-2015:0506-1

SUSE-SU-2015:0508-1

SUSE-SU-2015:2131-1

SUSE-SU-2015_0366-1

SUSE-SU-2015_0506-1

SUSE-SU-2015_0508-1

SUSE-SU-2015_2131-1

Affected Products

Suse

Libmspack

References · 46

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773041 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2015:2131-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9556 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9556 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0052 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0052.html · Security Note
• https://cve.org/CVERecord?id=CVE-2014-9556 · Security Note
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00004.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:0366-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9556 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9556 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0506-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9556 · Vendor Advisory