Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml (revision 387921) +++ security/vuxml/vuln.xml (working copy) @@ -57,6 +57,71 @@ --> + + cabextract -- directory traversal with UTF-8 symbols in filenames + + + cabextract + 1.6 + + + + +

Cabextract ChangeLog reports:

+
It was possible for cabinet files to extract to absolute file + locations, and it was possible on Cygwin to get around cabextract's + absolute and relative path protections by using backslashes.
+

+ + + + http://www.cabextract.org.uk/#changes + http://www.openwall.com/lists/oss-security/2015/02/18/3 + CVE-2015-2060 + + + 2015-02-18 + 2015-05-30 + + + + + libmspack -- frame_end overflow which could cause infinite loop + + + libmspack + 0.5 + + + cabextract + 1.5 + + + + +

There is a denial of service vulnerability in libmspack. The + libmspack code is built into cabextract, so it is also + vulnerable.

MITRE reports:

+
Integer overflow in the qtmd_decompress function in libmspack 0.4 + allows remote attackers to cause a denial of service (hang) via a + crafted CAB file, which triggers an infinite loop.
+

+ + + + CVE-2014-9556 + https://bugs.debian.org/773041 + http://www.openwall.com/lists/oss-security/2015/01/07/2 + + + 2014-12-11 + 2015-05-30 + + + proxychains-ng -- current path as the first directory for the library search path