CVE-2017-11423

What it actually does

Stack-based buffer over-read in cabd_read_string during parsing of malformed CAB archives, resulting in immediate process termination without data disclosure or code execution.

Why it matters to the business

Processing of untrusted archive files can trigger abrupt crashes in scanning or extraction tools, causing operational interruptions and requiring restarts until packages are updated.

How an attack unfolds

An attacker prepares a specially crafted CAB file and supplies it to a target system; when the vulnerable library attempts to read a string field from the archive header or data, the over-read occurs and the application terminates.

How to fix it

Upgrade fish to version 2.1.1-1 or later on Debian 10, 11, 12, and 13; rebuild or replace any local copies of libmspack 0.5alpha with a patched release.

How to confirm the fix worked

Verify installed package versions against the fixed releases, then reprocess known-good and boundary-case CAB files to confirm absence of crashes.

Typical attack path

1. Craft a CAB archive containing malformed string data
2. Deliver the file via email, web download, or shared storage
3. Trigger automated or manual processing by affected software
4. Observe denial-of-service crash

How to detect it

Inspect application and system logs for segmentation faults or crashes occurring during CAB file parsing; correlate timestamps with file-access events involving .cab extensions.

What your security team should do

• Apply the listed package updates immediately on all Debian systems running fish
• Add CAB file handling to crash-monitoring rules
• Review any custom builds that statically link libmspack