This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-18586 →

DEBIAN-CVE-2018-18586

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in...

Original description

The description as published by the source.

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libmspack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]

Debian:13 libmspack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]

Debian:14 libmspack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8-1"}]}]

References

advisory security-tracker.debian.org