Description
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing cabd->extract() to write up to 32 KiB of stale heap memory into extracted output.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kyz libmspack
Default version status: unaffected
0 to ≤ 0.11alphaaffected
pkg:github/kyz/libmspackReferences
- https://github.com/kyz/libmspack/issues/60 ↗
- https://github.com/kyz/libmspack/blob/v0.11alpha/libmspack/mspack/mszipd.c#L264-L276 ↗
- https://hackmd.io/@haindpwn/libmspack-mszip-uninit-window-info-leak ↗
- https://github.com/kyz/libmspack ↗
- https://www.vulncheck.com/advisories/libmspack-through-0-11alpha-uninitialized-memory-disclosure-via-ms-zip-decompressor-window ↗