libmspack -- frame_end overflow which could cause infinite loop

There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.
MITRE reports:

Integer overflow in the qtmd_decompress function in libmspack 0.4
allows remote attackers to cause a denial of service (hang) via a
crafted CAB file, which triggers an infinite loop.