CVE-2010-2801 | Vulnetix

CVE-2010-2801 PUBLISHED CVSS 5.099999904632568 MEDIUM

Integer signedness error in the Quantum decompressor in cabextract before 1.3, when archive test mode is used, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Quantum archive in a .cab file, related to the libmspack library.

EPSS 4.03% · 90.5th percentile

Risk Scores

CVSS 2.0

5.099999904632568

EPSS Score

4.03%

90.5th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
cabextract_project	cabextract	0, 0.1, 0.2

Timeline

Aug 6, 2010 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Oct 28, 2022 EPSS Score
Dec 20, 2022 EPSS Score
Feb 11, 2023 EPSS Score
Mar 27, 2023 EPSS Score
Apr 4, 2023 EPSS Score
May 27, 2023 EPSS Score
Jul 19, 2023 EPSS Score

References

http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=118 url
DSA-2087 vendor-advisory
[oss-security] 20100802 CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (crash) by processing certain *.cab files in test archive mode mailing-list
http://libmspack.svn.sourceforge.net/viewvc/libmspack/libmspack/trunk/mspack/qtmd.c?r1=114&r2=113 url
[oss-security] 20100802 Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (crash) by processing certain *.cab files in test archive mode mailing-list
http://www.cabextract.org.uk/#changes url
https://nvd.nist.gov/vuln/detail/CVE-2010-2801 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=620454 url
http://bugs.gentoo.org/show_bug.cgi?id=329891 url
http://www.vupen.com/english/advisories/2010/1903 url
http://www.vupen.com/english/advisories/2010/1997 url
http://www.securityfocus.com/bid/42173 technical
https://exchange.xforce.ibmcloud.com/vulnerabilities/60891 technical

Open in Interactive Console →