An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. ...

In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.

An integer wrap-around flaw has been reported in the way cabextract processed certain Cabinet (.cab) archive files. If a local user was tricked into opening a specially-crafted .cab archive in test archive mode, it could lead to cabextract executable crash.

References: [1] http://bugs.gentoo.org/showbug.cgi?id=329891

Upstream patches: [2] http://libmspack.svn.sourceforge.net/viewvc/libmspack/libmspack/trunk/mspack/qtmd.c?r1=114&r2=113 [3] http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=118

Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.

A deficiency has been reported in the way cabextract extracted certain Cabinet (.cab) files, using the MZ-ZIP and Quantum decompressors. If a local user was tricked into opening a specially-crafted .cab file, it could lead to infinite loop.

References: [1] http://bugs.gentoo.org/showbug.cgi?id=329891

Upstream patches: [2] http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=90 [3] http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=95 [4] http://libmspack.svn.sourceforge.net/viewvc/libmspack/libmspack/trunk/mspack/