CVE-2019-1010305: Buffer Overflow
Last updated 1 October 2025
Other sources
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmdreadheaders() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file.
Reference: https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d https://github.com/kyz/libmspack/issues/27
— Red Hat
libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmdreadheaders() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libmspackto a version that resolves this vulnerability.Fixed in 0.10.1-2Fixed in 0.11-1Fixed in 0.11-1.1 - Upgrade
Upgrade
alpine/libmspackto a version that resolves this vulnerability.Fixed in 0.8_alpha-r1 - Upgrade
Upgrade
alpine/libmspackto a version that resolves this vulnerability.Fixed in 0.10.1_alpha-r0 - Upgrade
Upgrade
redhat/libmspackto a version that resolves this vulnerability.Fixed in 0.10 - Upgrade
Upgrade
libmspackto a version that resolves this vulnerability.Patch 2f084136cfe0d05e5bf5703f3e83c6d955234b4d
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2019-1010305.
What is the impact of this vulnerability?
The impact of this vulnerability is information disclosure.
What is the affected component of this vulnerability?
The affected component of this vulnerability is the function chmd_read_headers() in libmspack.
What is the fixed version of libmspack?
The fixed version of libmspack is after commit 2f084136...
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [Link 1](https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d), [Link 2](https://github.com/kyz/libmspack/issues/27), [Link 3](https://lists.debian.org/debian-lts-announce/2019/08/msg00028.html)