CVE-2017-11423

CVE-2017-11423 affects libmspack’s cabd_read_string in mspack/cabd.c (0.5alpha) used by ClamAV before 0.99.4. A crafted CAB file can trigger a stack-based buffer over-read, causing denial of service. Connected advisories confirm the issue and point to upstream fixes in libmspack (0.6alpha and new...

CVE-2014-9556

CVE-2014-9556 affects libmspack 0.4 with an integer overflow in qtmd_decompress that can be triggered by a crafted CAB file, causing a remote denial of service via an infinite loop. Connected advisories indicate the issue is addressed by updates in downstream packages (e.g., cabextract/libmspack)...