Fedora 28: libmspack Security Update
Summary
The purpose of libmspack is to provide both compression and decompression of
some loosely related file formats used by Microsoft.
Latest stable releases of libmspack and cabextract, includes security fixes for
CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585
* Tue Nov 6 2018 Rex Dieter
- 0.9.1alpha
- libmspack-0.8-0.1.alpha corrupts extracted cab files (#1647033)
- examples no longer installed (by default)
* Tue Oct 30 2018 Rex Dieter
- 0.8alpha
- use %make_build %make_install %ldconfig_scriptlets %license
- devel: use %{?_isa} to tighten dep on main pkg
- drop deprecated Group: tag
- %files: tighten to include library soname
* Wed Aug 1 2018 Richard W.M. Jones
- New upstream version 0.7alpha.
- No tarball was uploaded so temporarily use tarball from github.
- Fixes CVE-2018-14679 libmspack: off-by-one error in the CHM PMGI/PMGL
chunk number validity checks
* Fri Jul 13 2018 Fedora Release Engineering
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
[ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes
https://bugzilla.redhat.com/show_bug.cgi?id=1644215
[ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h
https://bugzilla.redhat.com/show_bug.cgi?id=1644214
[ 3 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression
https://bugzilla.redhat.com/show_bug.cgi?id=1610941
[ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks
https://bugzilla.redhat.com/show_bug.cgi?id=1610934
[ 5 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c
https://bugzilla.redhat.com/show_bug.cgi?id=1610896
su -c 'dnf upgrade --advisory FEDORA-2018-cb337fb199' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
FEDORA-2018-cb337fb199 2018-11-13 02:25:35.636330 Product : Fedora 28 Version : 0.9.1 Release : 0.1.alpha.fc28 URL : https://www.cabextract.org.uk/libmspack/ Summary : Library for CAB and related files compression and decompression Description : The purpose of libmspack is to provide both compression and decompression of some loosely related file formats used by Microsoft. Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585 * Tue Nov 6 2018 Rex Dieter - 0.9.1-0.1.alpha - 0.9.1alpha - libmspack-0.8-0.1.alpha corrupts extracted cab files (#1647033) - examples no longer installed (by default) * Tue Oct 30 2018 Rex Dieter - 0.8-0.1.alpha - 0.8alpha - use %make_build %make_install %ldconfig_scriptlets %license - devel: use %{?_isa} to tighten dep on main pkg - drop deprecated Group: tag - %files: tighten to include library soname * Wed Aug 1 2018 Richard W.M. Jones - 0.7-0.1.alpha - New upstream version 0.7alpha. - No tarball was uploaded so temporarily use tarball from github. - Fixes CVE-2018-14679 libmspack: off-by-one error in the CHM PMGI/PMGL chunk number validity checks * Fri Jul 13 2018 Fedora Release Engineering - 0.6-0.3.alpha - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes https://bugzilla.redhat.com/show_bug.cgi?id=1644215 [ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h https://bugzilla.redhat.com/show_bug.cgi?id=1644214 [ 3 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression https://bugzilla.redhat.com/show_bug.cgi?id=1610941 [ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks https://bugzilla.redhat.com/show_bug.cgi?id=1610934 [ 5 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c https://bugzilla.redhat.com/show_bug.cgi?id=1610896 su -c 'dnf upgrade --advisory FEDORA-2018-cb337fb199' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Change Log
References