This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2018-18584 →
DEBIAN-CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block...
Original description
The description as published by the source.
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
cabextract
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5"}]}]
Debian:13
cabextract
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5"}]}]
Debian:14
cabextract
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5"}]}]
Debian:12
libmspack
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]
Debian:13
libmspack
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]
Debian:14
libmspack
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]
References
- advisory security-tracker.debian.org