CVE-2017-11423: Medium severity Libmspack Project Libmspack vulnerability
The cabdreadstring function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/clamavto a version that resolves this vulnerability.Fixed in 0.99.4-r0 - Upgrade
Upgrade
alpine/libmspackto a version that resolves this vulnerability.Fixed in 0.5_alpha-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11423?
The severity of CVE-2017-11423 is considered moderate due to its potential to cause denial of service.
How do I fix CVE-2017-11423?
To fix CVE-2017-11423, update the libmspack library to a version that is not affected by this vulnerability.
Who is affected by CVE-2017-11423?
CVE-2017-11423 affects users of libmspack version 0.5-alpha and ClamAV version 0.99.2.
What types of attacks can exploit CVE-2017-11423?
CVE-2017-11423 can be exploited by remote attackers using a specially crafted CAB file.
What are the potential impacts of CVE-2017-11423?
The potential impacts of CVE-2017-11423 include a stack-based buffer over-read and application crashes.