Launchpad.net

CVE 2018-18585

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

See the CVE page on Mitre.org for more details.