« Volver al listado

CVE-2010-2800

Estado: ModificadaMedia (4.3)—

The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action, related to the libmspack library.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cabextract Project — Cabextract

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2800",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-08-09T11:58:17.190",
  "references": [
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=329891",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=90",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=95",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=oss-security&m=128076168623266&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=oss-security&m=128077976522470&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.cabextract.org.uk/#changes",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/1903",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=620450",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=329891",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=90",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=95",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=oss-security&m=128076168623266&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=oss-security&m=128077976522470&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cabextract.org.uk/#changes",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/1903",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=620450",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action, related to the libmspack library."
    },
    {
      "lang": "es",
      "value": "El de-compresor MS-ZIP en cabextract anteriores a v1.3 permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de un fichero MSZIP manipulado en un fichero .cab durante un (1) test o (2) acción extract, relacionado con la librería libmspack."
    }
  ],
  "lastModified": "2026-06-16T23:21:31.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33B40EA4-BB4F-4A35-973F-BA856014B2F1",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D7B9CCF-67F3-4DC5-9362-09EE3D0FD87F"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "924128C3-DE58-4B6A-A497-59B5D3D311DE"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24D2543F-BE6B-46FB-93E0-C0F9DEC4490D"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B596E7E-F51E-4DFF-A81F-21E4C3C81F63"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63BDBB7A-673E-412B-BE69-05672AA3050D"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D5EC4F7-C88D-4DBA-A371-58DF4E6344A7"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "670769A1-4133-4834-94E0-BF5F3EF2FFF5"
            },
            {
              "criteria": "cpe:2.3:a:cabextract_project:cabextract:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDBD05D3-31A4-4079-A9E2-2B7EF6403624"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}