Executive Summary
| Summary | |
|---|---|
| Title | New chmlib packages fix denial of service |
| Informations | |||
|---|---|---|---|
| Name | DSA-1144 | First vendor Publication | 2006-08-07 |
| Vendor | Debian | Last vendor Modification | 2006-08-07 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that one of the utilities shipped with chmlib, a library for dealing with Microsoft CHM files, performs insufficient sanitising of filenames, which might lead to directory traversal. For the stable distribution (sarge) this problem has been fixed in version 0.35-6sarge3. For the unstable distribution (sid) this problem has been fixed in version 0.38-1. We recommend that you upgrade your chmlib-bin package. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1144 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 1144-1 (chmlib) File : nvt/deb_1144_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 26636 | CHM Lib extract_chmLib Traversal Arbitrary File Overwrite CHM Lib contains a flaw that allows a remote attacker to extract arbitrary files outside of the web path. The issue is due to the 'extract_chmLib' example program not properly sanitizing user input, specifically directory traversal style attacks (../../). |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1144.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:26:06 |
|
