CVE catalog

CVE-2018-14679

libmspack: CVE-2018-14679

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
3.27% · Oct 27, 2026

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibmspacksid0.11-2fixed
Debianlibmspackforky0.11-2fixed
Debianlibmspacktrixie0.11-1.1fixed
Debianlibmspackbookworm0.11-1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.3fixed
Ubuntulibmspackpro0.4-1vulnerable
Ubuntulibmspackpro0.4-1ubuntu0.1~esm1vulnerable
Ubuntulibmspackpro0.4-1ubuntu0.1~esm2fixed
Ubuntulibmspack16.040.5-1vulnerable
Ubuntulibmspack16.040.5-1ubuntu0.16.04.1vulnerable
Ubuntulibmspack16.040.5-1ubuntu0.16.04.2fixed
Ubuntulibmspack18.040.6-3vulnerable
Ubuntulibmspack18.040.6-3ubuntu0.1fixed
Ubuntulibmspack16.040.5-1vulnerable
Ubuntulibmspack16.040.5-1ubuntu0.16.04.1vulnerable
Ubuntulibmspack16.040.5-1ubuntu0.16.04.2fixed
Ubuntulibmspack18.040.6-3vulnerable
Ubuntulibmspack18.040.6-3ubuntu0.1fixed
Ubuntuclamav14.040.97.8+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.97.8+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu4vulnerable
Ubuntuclamav14.040.98.1+dfsg-1ubuntu5vulnerable
Ubuntuclamav14.040.98.1+dfsg-2ubuntu2vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1vulnerable
Ubuntuclamav14.040.98.1+dfsg-4ubuntu1.1vulnerable
Ubuntuclamav14.040.98.5+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.6+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.98.7+dfsg-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.2+addedllvm-0ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.99.3+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.99.4+addedllvm-0ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.1vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.2vulnerable
Ubuntuclamav14.040.100.1+dfsg-1ubuntu0.14.04.3fixed
Suseclamavhpe helion openstack 80.103.4-33.41.1fixed
Suseclamavopenstack cloud 80.103.4-33.41.1fixed
Suseclamavopenstack cloud 90.103.4-33.41.1fixed
Suseclamavopenstack cloud crowbar 80.103.4-33.41.1fixed
Suseclamavopenstack cloud crowbar 90.103.4-33.41.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp30.103.4-33.41.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp40.103.4-33.41.1fixed
Suseclamavlinux enterprise server 12 sp2-bcl0.103.4-33.41.1fixed
Suseclamavlinux enterprise server 12 sp3-ltss0.103.4-33.41.1fixed
Suseclamavlinux enterprise server 12 sp3-bcl0.103.4-33.41.1fixed
Suseclamavlinux enterprise server 12 sp4-ltss0.103.4-33.41.1fixed
Suseclamavlinux enterprise server 12 sp50.103.4-3.12.1fixed
Suseclamavlinux enterprise server for sap applications 12 sp50.103.4-3.12.1fixed
Opensuselibmspackleap 15.20.6-lp152.6.3.1fixed
Opensuselibmspackleap 15.30.6-3.11.1fixed
Suseclamavlinux enterprise micro 5.51.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise high performance computing 15 sp3-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise high performance computing 15 sp4-espos1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise high performance computing 15 sp4-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise high performance computing 15 sp5-espos1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise high performance computing 15 sp5-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server 15 sp3-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server 15 sp4-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server 15 sp5-ltss1.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp31.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp41.4.2-150200.8.3.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp51.4.2-150200.8.3.1fixed
Suseclamavmanager proxy 4.31.4.2-150200.8.3.1fixed
Suseclamavmanager server 4.31.4.2-150200.8.3.1fixed
Suseclamaventerprise storage 7.11.4.2-150200.8.3.1fixed
Suselibmspacklinux enterprise module for basesystem 15 sp20.6-3.11.1fixed
Suselibmspacklinux enterprise module for basesystem 15 sp30.6-3.11.1fixed
Suselibmspacklinux enterprise micro 5.00.6-3.11.1fixed
Suseclamavlinux enterprise server 12 sp5-ltss1.4.2-3.36.1fixed
Suseclamavlinux enterprise server ltss extended security 12 sp51.4.2-3.36.1fixed
Suseclamav-openssl1linux enterprise server 11-security0.103.4-0.20.41.1fixed
Suseclamavlinux enterprise point of sale 11 sp30.103.4-0.20.41.1fixed
Suseclamavlinux enterprise server 11 sp4-ltss0.103.4-0.20.41.1fixed
Alpinelibmspack3.100.7.1_alpha-r0fixed
Alpinelibmspack3.110.7.1_alpha-r0fixed
Alpinelibmspack3.50.7.1_alpha-r0fixed
Alpinelibmspack3.60.7.1_alpha-r0fixed
Alpinelibmspack3.70.7.1_alpha-r0fixed
Alpinelibmspack3.80.7.1_alpha-r0fixed
Alpinelibmspack3.90.7.1_alpha-r0fixed
Suseclamavlinux enterprise module for basesystem 15 sp61.4.2-150600.18.6.1fixed
Opensuseclamavleap 15.61.4.2-150600.18.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmspacksourcesid0.7-1not yet assignedNot reported[904802]
Debianlibmspacksourceforky0.7-1not yet assignedNot reported[904802]
Debianlibmspacksourcetrixie0.7-1not yet assignedNot reported[904802]
Debianlibmspacksourcebookworm0.7-1not yet assignedNot reported[904802]
Ubuntuclamavdeb14.040.100.1+dfsg-1ubuntu0.14.04.3Not reportedUBUNTU-CVE-2018-14679Not reported
Ubuntulibmspackdebpro0.4-1ubuntu0.1~esm2Not reportedUBUNTU-CVE-2018-14679Not reported
Ubuntulibmspackdeb16.040.5-1ubuntu0.16.04.2Not reportedUBUNTU-CVE-2018-14679Not reported
Ubuntulibmspackdeb18.040.6-3ubuntu0.1Not reportedUBUNTU-CVE-2018-14679Not reported
Ubuntulibmspackdeb16.040.5-1ubuntu0.16.04.2Not reportedUSN-3728-1Not reported
Ubuntulibmspackdeb18.040.6-3ubuntu0.1Not reportedUSN-3728-1Not reported
Ubuntuclamavdeb14.040.100.1+dfsg-1ubuntu0.14.04.3Not reportedUSN-3728-2Not reported
Suseclamavrpmhpe helion openstack 80.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmopenstack cloud 80.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmopenstack cloud 90.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmopenstack cloud crowbar 80.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmopenstack cloud crowbar 90.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp30.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp40.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server 12 sp2-bcl0.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server 12 sp3-ltss0.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server 12 sp3-bcl0.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server 12 sp4-ltss0.103.4-33.41.1Not reportedSUSE-SU-2021:3859-1Not reported
Suseclamavrpmlinux enterprise server 12 sp50.103.4-3.12.1Not reportedSUSE-SU-2021:3853-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 12 sp50.103.4-3.12.1Not reportedSUSE-SU-2021:3853-1Not reported
Opensuselibmspackrpmleap 15.20.6-lp152.6.3.1Not reportedOPENSUSE-SU-2021:1200-1Not reported
Opensuselibmspackrpmleap 15.30.6-3.11.1Not reportedOPENSUSE-SU-2021:2802-1Not reported
Suseclamavrpmlinux enterprise micro 5.51.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp3-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp4-espos1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp4-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp5-espos1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp5-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server 15 sp3-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server 15 sp4-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server 15 sp5-ltss1.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp31.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp41.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp51.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmmanager proxy 4.31.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmmanager server 4.31.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suseclamavrpmenterprise storage 7.11.4.2-150200.8.3.1Not reportedSUSE-SU-2025:0325-1Not reported
Suselibmspackrpmlinux enterprise module for basesystem 15 sp20.6-3.11.1Not reportedSUSE-SU-2021:2802-1Not reported
Suselibmspackrpmlinux enterprise module for basesystem 15 sp30.6-3.11.1Not reportedSUSE-SU-2021:2802-1Not reported
Suselibmspackrpmlinux enterprise micro 5.00.6-3.11.1Not reportedSUSE-SU-2021:2802-1Not reported
Suseclamavrpmlinux enterprise server 12 sp5-ltss1.4.2-3.36.1Not reportedSUSE-SU-2025:0328-1Not reported
Suseclamavrpmlinux enterprise server ltss extended security 12 sp51.4.2-3.36.1Not reportedSUSE-SU-2025:0328-1Not reported
Suseclamav-openssl1rpmlinux enterprise server 11-security0.103.4-0.20.41.1Not reportedSUSE-SU-2021:14850-1Not reported
Suseclamavrpmlinux enterprise point of sale 11 sp30.103.4-0.20.41.1Not reportedSUSE-SU-2021:14850-1Not reported
Suseclamavrpmlinux enterprise server 11 sp4-ltss0.103.4-0.20.41.1Not reportedSUSE-SU-2021:14850-1Not reported
Alpinelibmspackapk3.100.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.110.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.50.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.60.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.70.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.80.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Alpinelibmspackapk3.90.7.1_alpha-r0Not reportedALPINE-CVE-2018-14679Not reported
Suseclamavrpmlinux enterprise module for basesystem 15 sp61.4.2-150600.18.6.1Not reportedSUSE-SU-2025:0327-1Not reported
Opensuseclamavrpmleap 15.61.4.2-150600.18.6.1Not reportedSUSE-SU-2025:0327-1Not reported

[Debian bug #904802]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libmspack0]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1 · amd64 · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

    • 0.11-1 · arm64 · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

  • [libmspack-dev]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1 · amd64 · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

    • 0.11-1 · arm64 · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

  • [libmspack-doc]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1 · all · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

    • 0.11-1 · all · bookworm

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · bookworm; dsa · libmspack · debian · 12

[Debian 13 (Trixie)]

  • [libmspack0t64]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1.1+b1 · amd64 · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

    • 0.11-1.1+b1 · arm64 · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

  • [libmspack-dev]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1.1+b1 · amd64 · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

    • 0.11-1.1+b1 · arm64 · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

  • [libmspack-doc]Unknown

    Source package: [libmspack]

    Details (2)
    • 0.11-1.1 · all · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

    • 0.11-1.1 · all · trixie

      Fixed · Fixed: 0.7-1

      dsa · libmspack · debian · 13

Observed:

References