Security Advisory

This security advisory describes one low risk vulnerability.

1) Out-of-bounds read

Severity: Low

CVSSv3:
2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID:
CVE-2019-1010305

CWE-ID:
CWE-125 – Out-of-bounds Read

Exploit availability:
No

Description


The vulnerability allows an attacker to gain access to potentially sensitive information.


The vulnerability exists due to a boundary condition when processing a specially crafted chm file in libmspack 0.9.1alpha. A remote attacker can create a specially crafted chm file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse:
15.1

CPE

External links

https://lists.opensuse.org/opensuse-security-announce/2020-05/msg00068.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.





Source link

You must be logged in to post a comment.