BID:15338

Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability

Info

Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability

Bugtraq ID:	15338
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2005 12:00AM
Updated:	Nov 07 2005 12:00AM
Credit:	Discovered by Palasik Sandor.
Vulnerable:	Jed Wing CHM lib 0.37 Jed Wing CHM lib 0.36 Jed Wing CHM lib 0.35 Jed Wing CHM lib 0.33 Jed Wing CHM lib 0.32 Jed Wing CHM lib 0.31 Jed Wing CHM lib 0.3 Jed Wing CHM lib 0.2 Jed Wing CHM lib 0.1 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1

Not Vulnerable:	Jed Wing CHM lib 0.37.4

Discussion

Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability

CHM lib is susceptible to a buffer overflow vulnerability.

Reports indicate that this issue affects the LZX decompression method. It is conjectured that the vulnerability is remote in nature and allows attackers to execute arbitrary machine code in the context of the application that utilizes the CHM lib library.

Further details are not available at the moment. This BID will be updated when more information becomes available.

Exploit / POC

Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability

Solution:
CHM Lib 0.37.4 is not affected by this issue.

Debian has released advisory DSA 886-1 to address this issue. Please see the referenced advisory for more information.

Jed Wing CHM lib 0.1