The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.
References
| Link | Resource |
|---|---|
| https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ | Patch Third Party Advisory VDB Entry |
| https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html | Mailing List Third Party Advisory |
| https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ | Patch Third Party Advisory VDB Entry |
| https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html | Mailing List Third Party Advisory |
Configurations
History
21 Nov 2024, 03:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ - Patch, Third Party Advisory, VDB Entry | |
| References | () https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html - Mailing List, Third Party Advisory |
Information
Published : 2017-09-01 17:29
Updated : 2024-11-21 03:12
NVD link : CVE-2017-14107
Mitre link : CVE-2017-14107
CVE.ORG link : CVE-2017-14107
JSON object : View
Products Affected
libzip
- libzip
debian
- debian_linux
CWE
CWE-770
Allocation of Resources Without Limits or Throttling