CVE-2018-18585: Null Pointer Dereference
chmdreadheaders in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libmspackto a version that resolves this vulnerability.Fixed in 0.8 - Upgrade
Upgrade
redhat/cabextractto a version that resolves this vulnerability.Fixed in 1.8 - Upgrade
Upgrade
debian/libmspackto a version that resolves this vulnerability.Fixed in 0.10.1-2Fixed in 0.11-1Fixed in 0.11-1.1 - Upgrade
Upgrade
alpine/libmspackto a version that resolves this vulnerability.Fixed in 0.8_alpha-r0 - Upgrade
Upgrade
libmspackto a version that resolves this vulnerability.Fixed in 0.8alpha
Event History
Frequently Asked Questions
What is CVE-2018-18585?
CVE-2018-18585 is a vulnerability in the chmd_read_headers function in libmspack before version 0.8alpha.
What is the severity of CVE-2018-18585?
The severity of CVE-2018-18585 is medium, with a CVSS score of 4.3.
Which software packages are affected by CVE-2018-18585?
The affected software packages are libmspack before 0.8alpha and clamav.
How can I fix CVE-2018-18585 for libmspack?
To fix CVE-2018-18585 for libmspack, update to version 0.8alpha or later.
How can I fix CVE-2018-18585 for clamav?
To fix CVE-2018-18585 for clamav, update to version 0.100.2+dfsg-1ubuntu0.14.04.2 or later.