CVE-2018-14680
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2018-14680
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-14680.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2018-14680
- Downstream
- Related
- Published
- 2018-07-28T23:29:00Z
- Modified
- 2025-10-15T09:21:28.066958Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
- References
-
- http://www.openwall.com/lists/oss-security/2018/07/26/1
- http://www.securitytracker.com/id/1041410
- https://access.redhat.com/errata/RHSA-2018:3327
- https://access.redhat.com/errata/RHSA-2018:3505
- https://bugs.debian.org/904801
- https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a
- https://lists.debian.org/debian-lts-announce/2018/08/msg00007.html
- https://security.gentoo.org/glsa/201903-20
- https://usn.ubuntu.com/3728-1/
- https://usn.ubuntu.com/3728-2/
- https://usn.ubuntu.com/3728-3/
- https://usn.ubuntu.com/3789-2/
- https://www.debian.org/security/2018/dsa-4260
Affected packages
Git / github.com/kyz/libmspack
Affected ranges
- Type
- GIT
- Repo
- https://github.com/kyz/libmspack
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v0.*
v0.0.20060920alpha
v0.3alpha
v0.4alpha
v0.5alpha
v0.6alpha
v1.*
v1.0
v1.1
v1.2
v1.3
v1.4
v1.5
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"id": "CVE-2018-14680-4ca3b7ad",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"49925043302351673514388068494701907030",
"161712808870032329900961784810405018411",
"121485490807141736114950494978058559156",
"7489023390805984363603892804880154015",
"202644202232952523655974633013653707746",
"138619896882174347564468407303695257759",
"15990234950511709168994928365836356022",
"256898133550272973989357990071546787788",
"312328057604315597105613547714626917165",
"333854538769822575592451592026482133150",
"311166430157540248862665973352097654759",
"219884059926347081211079070659462285352",
"147707688935502192171362132058820901553",
"165585480514541969929312430367339872957"
]
},
"signature_type": "Line",
"target": {
"file": "libmspack/mspack/chmd.c"
},
"source": "https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a"
},
{
"signature_version": "v1",
"id": "CVE-2018-14680-7d4dd999",
"deprecated": false,
"digest": {
"function_hash": "107258753819447024680002702952495521063",
"length": 6599.0
},
"signature_type": "Function",
"target": {
"file": "libmspack/mspack/chmd.c",
"function": "chmd_read_headers"
},
"source": "https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a"
},
{
"signature_version": "v1",
"id": "CVE-2018-14680-c6a42638",
"deprecated": false,
"digest": {
"function_hash": "190023709558236809867088071942484683680",
"length": 1351.0
},
"signature_type": "Function",
"target": {
"file": "libmspack/mspack/chmd.c",
"function": "read_chunk"
},
"source": "https://github.com/kyz/libmspack/commit/72e70a921f0f07fee748aec2274b30784e1d312a"
}
]