5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.5%
Severity: High
Date : 2017-05-12
CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979
CVE-2017-5981
Package : zziplib
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-191
The package zziplib before version 0.13.66-2 is vulnerable to multiple
issues including arbitrary code execution and denial of service.
Upgrade to 0.13.66-2.
The problems have been fixed upstream in version 0.13.66.
None.
Heap-based buffer overflow in the __zzip_get32 function in fetch.c in
zziplib 0.13.62 allows remote attackers to cause a denial of service
(crash) via a crafted ZIP file.
Heap-based buffer overflow in the __zzip_get64 function in fetch.c in
zziplib 0.13.62 allows remote attackers to cause a denial of service
(crash) via a crafted ZIP file.
Heap-based buffer overflow in the zzip_mem_entry_extra_block function
in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a
denial of service (crash) via a crafted ZIP file.
The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote
attackers to cause a denial of service (NULL pointer dereference and
crash) via a crafted ZIP file.
seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of
service (assertion failure and crash) via a crafted ZIP file.
A remote attacker is able to crash the target process or execute
arbitrary code on the host by providing a malicious file.
https://bugs.archlinux.org/task/53133
http://www.openwall.com/lists/oss-security/2017/02/14/3
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get32-fetch-c/
https://github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42cdb184cd1
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get64-fetch-c/
https://github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e142ce03dd7
https://github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994dc2ca5734
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-zzip_mem_entry_extra_block-memdisk-c/
https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/
https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-c/
https://github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd9d6bc286
https://github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0e1bc806b
https://security.archlinux.org/CVE-2017-5974
https://security.archlinux.org/CVE-2017-5975
https://security.archlinux.org/CVE-2017-5976
https://security.archlinux.org/CVE-2017-5979
https://security.archlinux.org/CVE-2017-5981
www.openwall.com/lists/oss-security/2017/02/14/3
blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-c/
blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-zzip_mem_entry_extra_block-memdisk-c/
blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get32-fetch-c/
blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get64-fetch-c/
blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/
bugs.archlinux.org/task/53133
github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42cdb184cd1
github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0e1bc806b
github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994dc2ca5734
github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd9d6bc286
github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e142ce03dd7
security.archlinux.org/AVG-191
security.archlinux.org/CVE-2017-5974
security.archlinux.org/CVE-2017-5975
security.archlinux.org/CVE-2017-5976
security.archlinux.org/CVE-2017-5979
security.archlinux.org/CVE-2017-5981
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.5%