PT-2018-2693 · None+5 · Libmspack+6

Hanno Böck · Published 2018-10-22 · Updated 2025-01-22 · CVE-2018-18584

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libmspack versions prior to 0.8alpha cabextract versions prior to 1.8

Description The issue is related to an out-of-bounds write in the CAB block input buffer, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service. The problem arises because the buffer is one byte too small for the maximal Quantum block.

Recommendations For libmspack versions prior to 0.8alpha, update to version 0.8alpha or later to resolve the issue. For cabextract versions prior to 1.8, update to version 1.8 or later to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1110

ALT-PU-2021-1165

ALT-PU-2023-1005

ALT-PU-2023-1663

ALT-PU-2024-8946

ALT-PU-2025-1563

ALT-PU-2025-1661

BDU:2019-01362

CESA-2019_2049

CVE-2018-18584

DLA-1555-1

MGASA-2018-0455

OPENSUSE-SU-2024:13619-1

RHSA-2019:2049

RHSA-2019_2049

SUSE-SU-2019:0748-1

SUSE-SU-2019:13992-1

SUSE-SU-2019_0748-1

SUSE-SU-2019_13992-1

SUSE-SU-2020:2711-1

SUSE-SU-2020_2711-1

USN-3814-1

USN-3814-2

USN-3814-3

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Cabextract

Libmspack

References · 50

• https://github.com/kyz/libmspack/commit/40ef1b4093d77ad3a5cfcee1f5cb6108b3a3bcc2 · Patch
• https://advisories.mageia.org/MGASA-2018-0455.html · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-18584 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:13992-1 · Vendor Advisory
• https://usn.ubuntu.com/3814-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3814-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18584 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3814-2 · Vendor Advisory
• https://cabextract.org.uk/#changes · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3814-3 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18584 · Security Note
• https://ubuntu.com/security/CVE-2018-18584 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18584 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18584 · Vendor Advisory