Attachment 194977 Details for Bug 226491 – zziplib-vuln-rev4.xml

zziplib-vuln-rev4.xml

zziplib-vuln-rev4.xml (text/plain), 5.97 KB, created by Kai Knoblich on 2018-07-09 06:36:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kai Knoblich

Created: 2018-07-09 06:36:37 UTC

Size: 5.97 KB

patch

obsolete

>Index: vuln.xml
>===================================================================
>--- vuln.xml	(revision 474226)
>+++ vuln.xml	(working copy)
>@@ -58,6 +58,67 @@
>   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+  <vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
>+    <topic>zziplib - multiple vulnerabilities</topic>
>+    <affects>
>+      <package>
>+	<name>zziplib</name>
>+	<range><lt>0.13.68</lt></range>
>+      </package>
>+    </affects>
>+    <description>
>+      <body xmlns="http://www.w3.org/1999/xhtml">
>+	<p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p>
>+	<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=zziplib&amp;search_type=all&amp;pub_start_date=01%2F01%2F2017&amp;pub_end_date=07%2F06%2F2018">
>+	  <p>17 security fixes in this release:</p>
>+	  <ul>
>+	   <li>Medium CVE-2017-5974: Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5975: Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5976: Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5977: The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5978: The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5979: The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5980: The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2017-5981: seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.</li>
>+	   <li>Medium CVE-2018-6381: In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file-&gt;stored data.</li>
>+	   <li>Medium CVE-2018-6484: In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.</li>
>+	   <li>Medium CVE-2018-6540: In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.</li>
>+	   <li>Medium CVE-2018-6541: In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.</li>
>+	   <li>Medium CVE-2018-6542: In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.</li>
>+	   <li>Medium CVE-2018-6869: In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.</li>
>+	   <li>Medium CVE-2018-7725: An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service.</li>
>+	   <li>Medium CVE-2018-7726: An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.</li>
>+	   <li>Medium CVE-2018-7727: An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of service attack.</li>
>+	  </ul>
>+	</blockquote>
>+      </body>
>+    </description>
>+    <references>
>+      <cvename>CVE-2017-5974</cvename>
>+      <cvename>CVE-2017-5975</cvename>
>+      <cvename>CVE-2017-5976</cvename>
>+      <cvename>CVE-2017-5977</cvename>
>+      <cvename>CVE-2017-5978</cvename>
>+      <cvename>CVE-2017-5979</cvename>
>+      <cvename>CVE-2017-5980</cvename>
>+      <cvename>CVE-2017-5981</cvename>
>+      <cvename>CVE-2018-6381</cvename>
>+      <cvename>CVE-2018-6484</cvename>
>+      <cvename>CVE-2018-6540</cvename>
>+      <cvename>CVE-2018-6541</cvename>
>+      <cvename>CVE-2018-6542</cvename>
>+      <cvename>CVE-2018-6869</cvename>
>+      <cvename>CVE-2018-7725</cvename>
>+      <cvename>CVE-2018-7726</cvename>
>+      <cvename>CVE-2018-7727</cvename>
>+      <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&amp;results_type=overview&amp;query=zziplib&amp;search_type=all&amp;pub_start_date=01%2F01%2F2017&amp;pub_end_date=07%2F06%2F2018"</url>
>+    </references>
>+    <dates>
>+      <discovery>2017-03-01</discovery>
>+      <entry>2018-07-06</entry>
>+    </dates>
>+  </vuln>
>+
>   <vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
>     <topic>wordpress -- multiple issues</topic>
>     <affects>

Flags:

kai: maintainer-approval+

Actions: View

Attachments on bug 226491: 191360 | 191362 | 191575 | 191915 | 194919 | 194920 | 194922 | 194926 | 194927 | 194977