p PatchFirst

CVE-2018-18586

CVE-2018-18586

This page contains facts from public vulnerability sources. Check the original advisory before updating.

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

CVSS 5.3 · Medium · EPSS 3.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • libmspack Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.8-1

    Update to 0.8-1

  • libmspack Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.8-1

    Update to 0.8-1

  • libmspack Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.8-1

    Update to 0.8-1

Original sources

Check your server →