Issued:
2020-04-28
Updated:
2020-04-28

RHSA-2020:1686 - Security Advisory

Synopsis

Low: libmspack security and bug fix update

Type/Severity

Security Advisory: Low

Topic

An update for libmspack is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libmspack packages contain a library providing compression and extraction of the Cabinet (CAB) file format used by Microsoft.

Security Fix(es):

  • libmspack: buffer overflow in function chmd_read_headers() (CVE-2019-1010305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 1730568 - CVE-2019-1010305 libmspack: buffer overflow in function chmd_read_headers()
  • BZ - 1736743 - [RHEL-8.0/libmspack] Patch not fully applying

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
x86_64
libmspack-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: 74e145328b59086ff095b60715347d939d4ded3708be48ca5a7d5cbf3c1b28b8
libmspack-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 998c3e82a6bb9e040d225d8e85b5b55316d2ca92fcbb4d2ad0e6fa9e896c5cdb
libmspack-debuginfo-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: a99528dc5bbab04b3aa13408e1ff67e4a1c4df840ab174c843c6453140ebf0e5
libmspack-debuginfo-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 5f30a6b0d4a3cd5ac8bcabdf482988b19a33871c3a624b7d02f214390b66ca4d
libmspack-debugsource-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: 2d18fe37ac1174e2e8e0a36cc0f3e13a0e78a71fe99eb011d20311ea18e684cf
libmspack-debugsource-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 54d36df113b65a139e6e0701a7328f1abbb170371e164b1dedbb49258930ead0

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
ppc64le
libmspack-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: db7c21a594bf4641e0173ea4cfa6402e27e12423be51757b975ced16ce73c660
libmspack-debuginfo-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: 5353afdad84989605cb6d1b664dbb3d54839c4b50ae1724f8f417f573b751386
libmspack-debugsource-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: 67f8b1e93d49be3aca58ca1e6b4f223e0d0cf19f33ecc0b9e9df012e6c101526

Red Hat Enterprise Linux for ARM 64 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
aarch64
libmspack-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: 1801503c36382e22893a23d48e195daa0bcb9c35c72f47a0874e680bf2adf08e
libmspack-debuginfo-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: 23d731ac46d9b166fdcb12e32015ab5939f3bc5017bcfdd47739cf74ff2d7486
libmspack-debugsource-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: 3e4d424762a83fd79026c2985376de65cbd9254ab8ace954c4c998ec62e9583a

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
x86_64
libmspack-debuginfo-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: a99528dc5bbab04b3aa13408e1ff67e4a1c4df840ab174c843c6453140ebf0e5
libmspack-debuginfo-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 5f30a6b0d4a3cd5ac8bcabdf482988b19a33871c3a624b7d02f214390b66ca4d
libmspack-debugsource-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: 2d18fe37ac1174e2e8e0a36cc0f3e13a0e78a71fe99eb011d20311ea18e684cf
libmspack-debugsource-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 54d36df113b65a139e6e0701a7328f1abbb170371e164b1dedbb49258930ead0
libmspack-devel-0.7-0.3.alpha.el8.4.i686.rpm SHA-256: d3ea66bf384de28074325a68ce356c6fffb1e78a3fe1e2f5f18d3e17c8e4a2f2
libmspack-devel-0.7-0.3.alpha.el8.4.x86_64.rpm SHA-256: 795f786f5352d228f7cc9443e63cdcecbdb8a61129ac434e0cc6ce9c6411799a

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
ppc64le
libmspack-debuginfo-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: 5353afdad84989605cb6d1b664dbb3d54839c4b50ae1724f8f417f573b751386
libmspack-debugsource-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: 67f8b1e93d49be3aca58ca1e6b4f223e0d0cf19f33ecc0b9e9df012e6c101526
libmspack-devel-0.7-0.3.alpha.el8.4.ppc64le.rpm SHA-256: bbebc334adeca0a74b4604498088f591492acd84b27b133fd9fcd97d085dd276

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
aarch64
libmspack-debuginfo-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: 23d731ac46d9b166fdcb12e32015ab5939f3bc5017bcfdd47739cf74ff2d7486
libmspack-debugsource-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: 3e4d424762a83fd79026c2985376de65cbd9254ab8ace954c4c998ec62e9583a
libmspack-devel-0.7-0.3.alpha.el8.4.aarch64.rpm SHA-256: f5e07b7b4188952a4d1ad33b96f5ac7ae348b07ce1dff45b6f307d0ea3815315

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
libmspack-0.7-0.3.alpha.el8.4.src.rpm SHA-256: 05ac287b1727dc910ed031bf588109d80a57c712d4d5ea315042fc25c5224ceb
s390x
libmspack-0.7-0.3.alpha.el8.4.s390x.rpm SHA-256: 0b47b5f2222d39a3bd8415e298d462d9e214e0201eeb081fc92665a452a00a4a
libmspack-debuginfo-0.7-0.3.alpha.el8.4.s390x.rpm SHA-256: 70419e9debbafa01727a8034b4b5020baef4a5a916234f992cb9a28b86523fa5
libmspack-debugsource-0.7-0.3.alpha.el8.4.s390x.rpm SHA-256: 49cdca3cdfdc14c16c41c7942a4ccecd4b4bc9f6394e8348553ee87fddffe70e
libmspack-devel-0.7-0.3.alpha.el8.4.s390x.rpm SHA-256: 474f24e99605c2547b1a5bb5a18620e805357fa838fa2308d989c94f8bb9d75f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.