FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  512616
Date:      2019-09-23
Time:      09:01:54Z
Committer: tijl

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
43024078-9b63-11df-8983-001d60d86f38libmspack -- infinite loop denial of service

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

Secunia reports:

The vulnerability is caused due to an error when copying data from an uncompressed block (block type 0) and can be exploited to trigger an infinite loop by tricking an application using the library into processing specially crafted MS-ZIP archives.


Discovery 2010-07-26
Entry 2010-07-30
libmspack
le 0.0.20060920

cabextract
lt 1.3

http://secunia.com/advisories/40719/
cfb12f02-06e1-11e5-8fda-002590263bf5cabextract -- directory traversal with UTF-8 symbols in filenames

Cabextract ChangeLog reports:

It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes.


Discovery 2015-02-18
Entry 2015-05-31
cabextract
lt 1.6

http://www.cabextract.org.uk/#changes
http://www.openwall.com/lists/oss-security/2015/02/18/3
CVE-2015-2060
61480a9a-22b2-11d9-814e-0001020eed82cabextract -- insecure directory handling

cabextract has insufficient checks for file names that contain ../. This can cause files to be extracted to the parent directory.


Discovery 2004-10-18
Entry 2004-10-20
Modified 2004-10-22
cabextract
lt 1.1

CVE-2004-0916
http://www.kyz.uklinux.net/cabextract.php#changes
43024078-9b63-11df-8983-001d60d86f38libmspack -- infinite loop denial of service

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

Secunia reports:

The vulnerability is caused due to an error when copying data from an uncompressed block (block type 0) and can be exploited to trigger an infinite loop by tricking an application using the library into processing specially crafted MS-ZIP archives.


Discovery 2010-07-26
Entry 2010-07-30
libmspack
le 0.0.20060920

cabextract
lt 1.3

http://secunia.com/advisories/40719/
61480a9a-22b2-11d9-814e-0001020eed82cabextract -- insecure directory handling

cabextract has insufficient checks for file names that contain ../. This can cause files to be extracted to the parent directory.


Discovery 2004-10-18
Entry 2004-10-20
Modified 2004-10-22
cabextract
lt 1.1

CVE-2004-0916
http://www.kyz.uklinux.net/cabextract.php#changes
cc7548ef-06e1-11e5-8fda-002590263bf5libmspack -- frame_end overflow which could cause infinite loop

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

MITRE reports:

Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.


Discovery 2014-12-11
Entry 2015-05-31
libmspack
lt 0.5

cabextract
lt 1.5

CVE-2014-9556
https://bugs.debian.org/773041
http://www.openwall.com/lists/oss-security/2015/01/07/2