Description
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
twogood unshield
Default version status: unaffected
0 to ≤ 1.6.2affected
pkg:github/twogood/unshieldReferences
- https://hackmd.io/@haind-pwn/unshield-header-filetable-oob-read ↗
- https://github.com/twogood/unshield/blob/51de441ba6893f11026d4671ccef9e8e2a4634fa/lib/libunshield.c#L195 ↗
- https://github.com/twogood/unshield ↗
- https://www.vulncheck.com/advisories/unshield-through-1.6.2-heap-out-of-bounds-read-via-unshield-get-file-table ↗