oss-security - Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (crash) by processing certain *.cab files in test archive mode

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1671447452.190931280779738889.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 2 Aug 2010 16:08:58 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request [two ids] -- cabextract -- 1,
 Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around
 (crash) by processing certain *.cab files in test archive mode

----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Hi Steve, vendors,
> 
>    two security issues have been reported against cabextract:
> 
> 1, Infinite loop in MS-ZIP and Quantum decoders (minor issue):
> 
> A deficiency has been reported in the way cabextract extracted certain
> Cabinet (*.cab) files, using the MZ-ZIP and Quantum decompressors.  If a
> local user was tricked into opening a specially-crafted *.cab file, it
> could lead to infinite loop.
> 

CVE-2010-2800

> 2, Integer wrap-around (crash) by processing certain *.cab files in
> test archive mode
> 
> An integer wrap-around flaw has been reported in the way cabextract
> processed certain Cabinet (*.cab) archive files. If a local user was
> tricked into opening a specially-crafted *.cab archive in test archive
> mode, it could lead to cabextract executable crash.
> 

CVE-2010-2801

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.