libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.

A deficiency has been reported in the way cabextract extracted certain Cabinet (.cab) files, using the MZ-ZIP and Quantum decompressors. If a local user was tricked into opening a specially-crafted .cab file, it could lead to infinite loop.

References: [1] http://bugs.gentoo.org/showbug.cgi?id=329891

Upstream patches: [2] http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=90 [3] http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=95 [4] http://libmspack.svn.sourceforge.net/viewvc/libmspack/libmspack/trunk/mspack/