CVE-2015-4469
Fixed in a distro release EPSS 1%
The chmd_read_headers function in chmd.c in libmspack before 0.5 does not validate name lengths, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted CHM file.
Products: libmspack_project libmspack
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libmspack | 0.4-3 |
| Debian 13 | libmspack | 0.4-3 |
| Debian 14 | libmspack | 0.4-3 |
| SUSE Linux Enterprise Desktop 11 SP3 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Desktop 11 SP4 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Desktop 12 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Desktop 12 SP1 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Server 11 SP3 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Server 11 SP4 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Server 12 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Server 12 SP1 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libmspack | 0.0.20060920alpha-74.10.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libmspack | 0.4-14.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libmspack | 0.4-14.4 |
| Ubuntu Pro 14.04 LTS | libmspack | 0.4-1ubuntu0.1~esm2 |