Bug 934525 - (CVE-2015-4467) VUL-1: CVE-2015-4467: cabextract,libmspack: denial of service while processing crafted CHM file (floating point exception)
(CVE-2015-4467)
VUL-1: CVE-2015-4467: cabextract,libmspack: denial of service while processin...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/117583/
CVSSv2:NVD:CVE-2015-4467:4.3:(AV:N/AC...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-06-12 09:24 UTC by Andreas Stieger
Modified: 2020-09-23 15:58 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-06-12 09:24:24 UTC
rh#1180175

The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not
properly validate the reset interval, which allows remote attackers to cause a
denial of service (divide-by-zero error and application crash) via a crafted CHM
file.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1180175
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4467
http://seclists.org/oss-sec/2015/q2/691
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774726#3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774725
http://anonscm.debian.org/cgit/collab-maint/libmspack.git/commit/?id=a25bb144795e526748b57884daf365732c7e2295
http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-division-by-zero.patch?id=a25bb144795e526748b57884daf365732c7e2295

For SLE 11, this needs to be fixed libmspack and cabextract.
For SLE 12, cabextract builds --with-external-libmspack, so only libmspack needs to be fixed.
Comment 1 Swamp Workflow Management 2015-06-12 09:39:54 UTC
An update workflow for this issue was started.
This issue was rated as low.
Please submit fixed packages until 2015-07-10.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/61986
Comment 2 Swamp Workflow Management 2015-06-12 22:02:13 UTC
bugbot adjusting priority
Comment 3 Stanislav Brabec 2015-06-15 18:17:28 UTC
Taking fix-division-by-zero.patch from Debian.
Comment 4 Stanislav Brabec 2015-06-15 19:22:11 UTC
The same is in the upstream as well: https://github.com/kyz/libmspack/commit/b3102f4707a32d60514c06c399c3be4caffd7f25
Comment 6 Stanislav Brabec 2015-06-16 18:42:59 UTC
Backport of this patch to SLE11 libmspack was easy and straightforward:

https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11
Comment 7 Stanislav Brabec 2015-06-16 19:08:08 UTC
Done.

https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11
libmspack: https://build.suse.de/request/show/60558
cabextract: not affected CHM decompression is not implemented
Comment 13 Swamp Workflow Management 2015-12-07 17:11:54 UTC
SUSE-SU-2015:2215-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 934524,934525,934526,934527,934528,934529
CVE References: CVE-2014-9732,CVE-2015-4467,CVE-2015-4469,CVE-2015-4470,CVE-2015-4471,CVE-2015-4472
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
Comment 14 Swamp Workflow Management 2016-01-04 13:13:10 UTC
SUSE-SU-2016:0011-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 934524,934525,934526,934527,934528,934529
CVE References: CVE-2014-9732,CVE-2015-4467,CVE-2015-4468,CVE-2015-4469,CVE-2015-4470,CVE-2015-4471,CVE-2015-4472
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Software Development Kit 12 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Server 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Server 12 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Desktop 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Desktop 12 (src):    libmspack-0.4-14.4
Comment 15 Wolfgang Frisch 2020-09-23 15:58:53 UTC
All supported code streams are fixed.