Bug 10147

Summary: libmspack security vulnerability (CVE-2019-1010305)
Product: [ROSA-based products] ROSA Fresh Reporter: Zombie Ryushu <zombie.ryushu>
Component: Packages from MainAssignee: ROSA Linux Bugs <bugs>
Status: VERIFIED FIXED QA Contact: ROSA Linux Bugs <bugs>
Severity: normal    
Priority: Normal CC: alzim, andrey.bondrov, denis.silakov, mc2374, pastordidi, v.potapov
Version: AllFlags: v.potapov: qa_verified+
andrey.bondrov: published+
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: https://advisories.mageia.org/MGASA-2019-0248.html
Whiteboard:
Platform: --- ROSA Vulnerability identifier: CVE-2019-1010305
RPM Package: libmspack ISO-related:
Bad POT generating: Upstream:

Description Zombie Ryushu 2019-09-10 08:42:09 MSK 
Updated libmspack packages fix security vulnerability:

It was discovered that libmspack incorrectly handled certain CHM files.
A remote attacker could possibly use this issue to access sensitive
information (CVE-2019-1010305).
Comment 1 Andrey Bondrov 2019-09-10 16:08:08 MSK 
Advisory: "Update libmspack to new version 0.10.1 to fix CVE-2019-1010305"

https://abf.rosalinux.ru/build_lists/3094868
https://abf.rosalinux.ru/build_lists/3094869

Rebuild packages that use libmspack:

cabextract:
https://abf.rosalinux.ru/build_lists/3094886
https://abf.rosalinux.ru/build_lists/3094887

open-vm-tools:
https://abf.rosalinux.ru/build_lists/3094904
https://abf.rosalinux.ru/build_lists/3094905
Comment 2 Dmitry Postnikov 2019-09-11 23:41:06 MSK 
The update is sent to expanded testing
***************************************
Comment 3 Vladimir Potapov 2019-09-19 11:05:46 MSK 
libmspack-0.10.1-0.alpha.1
https://abf.rosalinux.ru/build_lists/3094868
https://abf.rosalinux.ru/build_lists/3094869

cabextract-1.9.1-1
https://abf.rosalinux.ru/build_lists/3094886
https://abf.rosalinux.ru/build_lists/3094887

open-vm-tools-10.0.7-8
https://abf.rosalinux.ru/build_lists/3094904
https://abf.rosalinux.ru/build_lists/3094905
****************************** Advisory ****************************
Update libmspack to new version 0.10.1 to fix CVE-2019-1010305
********************************************************************
QA Verified