CVE-2019-1010305

Name	CVE-2019-1010305
Description	libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1895-1, DLA-2805-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libmspack (PTS)	jessie, jessie (lts)	0.5-1+deb8u4	fixed
	stretch (security), stretch (lts), stretch	0.5-1+deb9u4	fixed
	buster	0.10.1-1	fixed
	bullseye	0.10.1-2	fixed
	bookworm	0.11-1	fixed
	sid, trixie	0.11-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
libmspack	source	wheezy	(unfixed)	end-of-life
libmspack	source	jessie	0.5-1+deb8u4		DLA-1895-1
libmspack	source	stretch	0.5-1+deb9u4		DLA-2805-1
libmspack	source	(unstable)	0.10.1-1

https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d
https://github.com/kyz/libmspack/issues/27