CVE:CVE-2018-18586
CNNVD:CNNVD-201810-1145
Libmspack是一款能够对CAB、CHM和HLP等格式文件进行压缩和解压的库。
Libmspack 0.8alpha之前版本中的chmextract sample程序的chmextract.c文件存在路径遍历漏洞。攻击者可借助特制的URL请求利用该漏洞在系统上执行任意代码。
solution:Upgrade kyzer libmspack to a higher version than 0.3:alpha,0.4:alpha,0.5:alpha,0.6:alpha,0.7:alpha,and avoid the version 0.3:alpha,0.4:alpha,0.5:alpha,0.6:alpha,0.7:alpha