CVE-2018-18586 — Vulnetix

Try Vulnetix Request Demo

CVE-2018-18586 PUBLISHED CVSS 5.300000190734863 MEDIUM

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

EPSS 0.52% · 66.4th percentile

Risk Scores

CVSS v3.0

5.300000190734863

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.52%

66.4th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
kyzer	libmspack	0.3, 0.4, 0.5

Timeline

Oct 23, 2018 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Feb 25, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Jan 2, 2023 EPSS Score

References

https://github.com/kyz/libmspack/commit/7cadd489698be117c47efcadd742651594429e6d url
https://www.openwall.com/lists/oss-security/2018/10/22/1 url
https://bugs.debian.org/911639 url
GLSA-201903-20 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-18586 advisory

Open in Interactive Console →