CVE:CVE-2018-14679
CNNVD:CNNVD-201807-1913
Libmspack是一款能够对CAB、CHM和HLP等格式文件进行压缩和解压的库。
libmspack 0.7alpha之前版本的mspack/chmd.c中存在安全漏洞，该漏洞源于CHM的TOLOWER()宏中有一个off by one错误，允许攻击者导致拒绝服务。
solution:Upgrade cabextract libmspack to a higher version than 0.0.20060920:alpha,0.3:alpha,0.4:alpha,0.5:alpha,0.6:alpha,and avoid the version 0.0.20060920:alpha,0.3:alpha,0.4:alpha,0.5:alpha,0.6:alpha; Upgrade cabextract_project cabextract to a higher version than 1.5,and avoid the version (,1.5]; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,16.04,18.04,and avoid the version 12.04,14.04,16.04,18.04; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade redhat ansible_tower to a higher version than 3.3,and avoid the version 3.3; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0