Some vulnerabilities have been reported in CHM Lib (chmlib), which potentially can be exploited by malicious people to compromise a user's system.

1) A boundary error exists in the "_chm_decompress_block()" function when reading input from a ".chm" file into a stack buffer. This can be exploited to cause a stack-based buffer overflow and may allow arbitrary code execution via a specially crafted ".chm" file.

The vulnerability has been reported in version 0.36 and prior.

2) A boundary error exists in the "_chm_find_in_PMGL()" function when reading input from a ".chm" file into a stack buffer. This can be exploited to cause a stack-based buffer overflow and may allow arbitrary code execution via a specially crafted ".chm" file.

3) An unspecified boundary error exists when performing LZX decompression. This may be exploited to cause a buffer overflow.

Vulnerability #2 and #3 has been reported in version 0.35.

Note: The vulnerabilities potentially affect other applications that use the library.

Solution
Update to version 0.37.
Further details available in Customer Area

Provided and/or discovered by
1) Sven Tantau
2) Discovered by anonymous and reported via iDEFENSE.
3) Palasik Sandor

Changelog
Further details available in Customer Area

Original Advisory
Sven Tantau:
http://www.sven-tantau.de/public_files/chmlib/chmlib_20051126.txt

iDEFENSE:
http://www.idefense.com/application/poi/display?id=332&type=vulnerabilities

Deep Links
Links available in Customer Area