Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00009.html | |
| https://access.redhat.com/errata/RHSA-2019:2159 | |
| https://bugzilla.suse.com/show_bug.cgi?id=1110194 | Exploit Issue Tracking Patch Third Party Advisory |
| https://sourceforge.net/p/infozip/bugs/53/ | Patch Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00009.html | |
| https://access.redhat.com/errata/RHSA-2019:2159 | |
| https://bugzilla.suse.com/show_bug.cgi?id=1110194 | Exploit Issue Tracking Patch Third Party Advisory |
| https://sourceforge.net/p/infozip/bugs/53/ | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 03:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00009.html - | |
| References | () https://access.redhat.com/errata/RHSA-2019:2159 - | |
| References | () https://bugzilla.suse.com/show_bug.cgi?id=1110194 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | () https://sourceforge.net/p/infozip/bugs/53/ - Patch, Third Party Advisory |
Information
Published : 2018-10-16 16:50
Updated : 2024-11-21 03:55
NVD link : CVE-2018-18384
Mitre link : CVE-2018-18384
CVE.ORG link : CVE-2018-18384
JSON object : View
Products Affected
unzip_project
- unzip
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer