PT-2018-3394

Name of the Vulnerable Software and Affected Versions: ZZIPlib version 0.13.67 Description: The issue is related to the zzip disk findfirst function in the zzip/mmapped.c file, which can cause a bus error due to the loading of a misaligned address. This can be exploited by remote attackers to cau...

DEBIAN-CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

The vulnerability of the component’s dispatcher in SageCRM’s customer relationship management system allows a hacker to increase their privileges and impact the confidentiality, integrity, and accessibility of data.

The vulnerability of the component dispatcher in SageCRM’s customer relationship management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to increase their privileges and compromise the confidentiality, integrity, and...

AZL-45219 CVE-2017-5974 affecting package zziplib for versions less than 0.13.74-1

Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

DEBIAN-CVE-2017-5979

The prescanentry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

CVE-2017-5975

Heap-based buffer overflow in the zzipget64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

CVE-2017-5977

The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP file...

CVE-2017-5980

The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

CVE-2017-5981

seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service assertion failure and crash via a crafted ZIP file...

DEBIAN-CVE-2017-5981

seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service assertion failure and crash via a crafted ZIP file...

DEBIAN-CVE-2017-5978

The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted ZIP file...

AZL-43603 CVE-2017-5974 affecting package zziplib 0.13.72-3

Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

CVE-2017-5979

The prescanentry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. Heap-based buffer overflow in the zzipmementryextrablock function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via ...

Out-of-bounds Read

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Out-of-bounds Read. The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP...

Out-of-Bounds

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Out-of-Bounds. Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a...

Design/Logic Flaw

The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP file...

CVE-2017-5977

The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP file...

Heap overflow

Heap-based buffer overflow in the zzipmementryextrablock function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...