{"id": "CVE-2019-13453", "bulletinFamily": "NVD", "title": "CVE-2019-13453", "description": "Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().", "published": "2019-07-17T15:15:00", "modified": "2020-08-24T17:37:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13453", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/bid/109282", "https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/", "https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/"], "cvelist": ["CVE-2019-13453"], "type": "cve", "lastseen": "2021-04-23T00:45:09", "edition": 9, "viewCount": 3, "enchantments": {"dependencies": {"modified": "2021-02-02T07:12:50", "references": [{"idList": ["USN-4057-1", "USN-4055-1"], "type": "ubuntu"}, {"idList": ["UBUNTU_USN-4055-1.NASL", "UBUNTU_USN-4057-1.NASL"], "type": "nessus"}, {"idList": ["OPENVAS:1361412562310844092", "OPENVAS:1361412562310844093"], "type": "openvas"}], "rev": 2}, "score": {"modified": "2021-02-02T07:12:50", "rev": 2, "value": 3.9, "vector": "NONE"}, "vulnersScore": 3.9}, "cpe": [], "affectedSoftware": [{"cpeName": "zipios_project:zipios", "name": "zipios project zipios", "operator": "lt", "version": "0.1.7"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": [], "cwe": ["CWE-835"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:zipios_project:zipios:0.1.7:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "0.1.7", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/", "refsource": "CONFIRM", "tags": ["Patch", "Third Party Advisory"], "url": "https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/"}, {"name": "https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/", "refsource": "MISC", "tags": ["Patch", "Third Party Advisory"], "url": "https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/"}, {"name": "109282", "refsource": "BID", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/109282"}], "immutableFields": []}

{"nessus": [{"lastseen": "2021-04-01T07:35:29", "description": "Mike Salvatore discovered that Zipios mishandled certain malformed ZIP\nfiles. An attacker could use this vulnerability to cause a denial of\nservice or consume system resources. (CVE-2019-13453).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 20, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "published": "2019-07-16T00:00:00", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Zipios vulnerability (USN-4057-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-13453"], "modified": "2021-04-02T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.10", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:19.04", "p-cpe:/a:canonical:ubuntu_linux:libzipios++0v5"], "id": "UBUNTU_USN-4057-1.NASL", "href": "https://www.tenable.com/plugins/nessus/126747", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4057-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126747);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/08\");\n\n script_cve_id(\"CVE-2019-13453\");\n script_xref(name:\"USN\", value:\"4057-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Zipios vulnerability (USN-4057-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mike Salvatore discovered that Zipios mishandled certain malformed ZIP\nfiles. An attacker could use this vulnerability to cause a denial of\nservice or consume system resources. (CVE-2019-13453).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4057-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libzipios++0v5 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libzipios++0v5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/07/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/07/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/07/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|18\\.10|19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 18.10 / 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libzipios++0v5\", pkgver:\"0.1.5.9+cvs.2007.04.28-5.2ubuntu0.16.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"libzipios++0v5\", pkgver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"libzipios++0v5\", pkgver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.10.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"libzipios++0v5\", pkgver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.19.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libzipios++0v5\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-04-01T07:35:29", "description": "Mike Salvatore discovered that FlightCrew improperly handled certain\nmalformed EPUB files. An attacker could potentially use this\nvulnerability to cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed\nEPUB files. An attacker could use this vulnerability to write\narbitrary files to the filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in\nFlightCrew mishandled certain malformed ZIP files. An attacker could\nuse this vulnerability to cause a denial of service or consume system\nresources. (CVE-2019-13453).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 20, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2019-07-16T00:00:00", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : flightcrew vulnerabilities (USN-4055-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-13453", "CVE-2019-13032", "CVE-2019-13241"], "modified": "2021-04-02T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.10", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:19.04", "p-cpe:/a:canonical:ubuntu_linux:flightcrew", "p-cpe:/a:canonical:ubuntu_linux:libflightcrew0v5"], "id": "UBUNTU_USN-4055-1.NASL", "href": "https://www.tenable.com/plugins/nessus/126745", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4055-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126745);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2020/01/08\");\n\n script_cve_id(\"CVE-2019-13032\", \"CVE-2019-13241\", \"CVE-2019-13453\");\n script_xref(name:\"USN\", value:\"4055-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : flightcrew vulnerabilities (USN-4055-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mike Salvatore discovered that FlightCrew improperly handled certain\nmalformed EPUB files. An attacker could potentially use this\nvulnerability to cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed\nEPUB files. An attacker could use this vulnerability to write\narbitrary files to the filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in\nFlightCrew mishandled certain malformed ZIP files. An attacker could\nuse this vulnerability to cause a denial of service or consume system\nresources. (CVE-2019-13453).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/4055-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected flightcrew and / or libflightcrew0v5 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:flightcrew\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libflightcrew0v5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/07/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/07/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|18\\.10|19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 18.10 / 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"flightcrew\", pkgver:\"0.7.2+dfsg-6ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libflightcrew0v5\", pkgver:\"0.7.2+dfsg-6ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"flightcrew\", pkgver:\"0.7.2+dfsg-10ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"libflightcrew0v5\", pkgver:\"0.7.2+dfsg-10ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"flightcrew\", pkgver:\"0.7.2+dfsg-12ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"libflightcrew0v5\", pkgver:\"0.7.2+dfsg-12ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"flightcrew\", pkgver:\"0.7.2+dfsg-13ubuntu0.19.04.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"libflightcrew0v5\", pkgver:\"0.7.2+dfsg-13ubuntu0.19.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"flightcrew / libflightcrew0v5\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-07-23T15:47:56", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-13453"], "description": "The remote host is missing an update for the ", "modified": "2019-07-23T00:00:00", "published": "2019-07-16T00:00:00", "id": "OPENVAS:1361412562310844092", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844092", "type": "openvas", "title": "Ubuntu Update for zipios++ USN-4057-1", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844092\");\n script_version(\"2019-07-23T06:55:12+0000\");\n script_cve_id(\"CVE-2019-13453\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-23 06:55:12 +0000 (Tue, 23 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-07-16 02:00:42 +0000 (Tue, 16 Jul 2019)\");\n script_name(\"Ubuntu Update for zipios++ USN-4057-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.10|UBUNTU19\\.04|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4057-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-July/005009.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'zipios++'\n package(s) announced via the USN-4057-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An\nattacker could use this vulnerability to cause a denial of service or consume\nsystem resources. (CVE-2019-13453)\");\n\n script_tag(name:\"affected\", value:\"'zipios++' package(s) on Ubuntu 19.04, Ubuntu 18.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"0v5\", ver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.10.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"0v5\", ver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"0v5\", ver:\"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"0v5\", ver:\"0.1.5.9+cvs.2007.04.28-5.2ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-07-19T21:46:38", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-13453", "CVE-2019-13032", "CVE-2019-13241"], "description": "The remote host is missing an update for the ", "modified": "2019-07-17T00:00:00", "published": "2019-07-16T00:00:00", "id": "OPENVAS:1361412562310844093", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844093", "type": "openvas", "title": "Ubuntu Update for flightcrew USN-4055-1", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844093\");\n script_version(\"2019-07-17T08:19:47+0000\");\n script_cve_id(\"CVE-2019-13032\", \"CVE-2019-13241\", \"CVE-2019-13453\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:19:47 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-07-16 02:00:42 +0000 (Tue, 16 Jul 2019)\");\n script_name(\"Ubuntu Update for flightcrew USN-4055-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.10|UBUNTU19\\.04|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"4055-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-July/005007.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'flightcrew'\n package(s) announced via the USN-4055-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Mike Salvatore discovered that FlightCrew improperly handled certain\nmalformed EPUB files. An attacker could potentially use this vulnerability\nto cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed EPUB\nfiles. An attacker could use this vulnerability to write arbitrary files to\nthe filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in FlightCrew\nmishandled certain malformed ZIP files. An attacker could use this vulnerability\nto cause a denial of service or consume system resources. (CVE-2019-13453)\");\n\n script_tag(name:\"affected\", value:\"'flightcrew' package(s) on Ubuntu 19.04, Ubuntu 18.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"flightcrew\", ver:\"0.7.2+dfsg-12ubuntu0.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libflightcrew0v5\", ver:\"0.7.2+dfsg-12ubuntu0.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"flightcrew\", ver:\"0.7.2+dfsg-13ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libflightcrew0v5\", ver:\"0.7.2+dfsg-13ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"flightcrew\", ver:\"0.7.2+dfsg-10ubuntu0.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libflightcrew0v5\", ver:\"0.7.2+dfsg-10ubuntu0.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"flightcrew\", ver:\"0.7.2+dfsg-6ubuntu0.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libflightcrew0v5\", ver:\"0.7.2+dfsg-6ubuntu0.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2020-07-02T11:39:27", "bulletinFamily": "unix", "cvelist": ["CVE-2019-13453"], "description": "Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An \nattacker could use this vulnerability to cause a denial of service or consume \nsystem resources. (CVE-2019-13453)", "edition": 3, "modified": "2019-07-15T00:00:00", "published": "2019-07-15T00:00:00", "id": "USN-4057-1", "href": "https://ubuntu.com/security/notices/USN-4057-1", "title": "Zipios vulnerability", "type": "ubuntu", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-07-02T11:39:38", "bulletinFamily": "unix", "cvelist": ["CVE-2019-13453", "CVE-2019-13032", "CVE-2019-13241"], "description": "Mike Salvatore discovered that FlightCrew improperly handled certain \nmalformed EPUB files. An attacker could potentially use this vulnerability \nto cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed EPUB \nfiles. An attacker could use this vulnerability to write arbitrary files to \nthe filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in FlightCrew \nmishandled certain malformed ZIP files. An attacker could use this vulnerability \nto cause a denial of service or consume system resources. (CVE-2019-13453)", "edition": 2, "modified": "2019-07-15T00:00:00", "published": "2019-07-15T00:00:00", "id": "USN-4055-1", "href": "https://ubuntu.com/security/notices/USN-4055-1", "title": "flightcrew vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}