Description
chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which triggers memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | chmlib | 2:0.39-1 | — |
| Debian 13 | chmlib | 2:0.39-1 | — |
| Debian 12 | chmlib | 2:0.39-1 | — |
References
- 1017565 vdb-entry
- 23975 third-party-advisory
- ADV-2007-0361 vdb-entry
- SUSE-SR:2007:003 vendor-advisory
- 22258 vdb-entry
- 24335 third-party-advisory
- 20070126 Multiple Vendor libchm Page Block Length Memory Corruption Vulnerability third-party-advisory
- GLSA-200702-12 vendor-advisory
- http://morte.jedrea.com/~jedwin/projects/chmlib/