ZZIPlib '__zzip_fetch_disk_trailer' function denial of service vulnerability

ZZIPlib is a set of lightweight file compression tools. A security vulnerability exists in the 'zzipfetchdisktrailer' function in the zzip/zip.c file in ZZIPlib version 0.13.67. A remote attacker can exploit this vulnerability to cause a denial of service via a specially crafted zip file...

DEBIAN-CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

The vulnerability of the component’s dispatcher in SageCRM’s customer relationship management system allows a hacker to increase their privileges and impact the confidentiality, integrity, and accessibility of data.

The vulnerability of the component dispatcher in SageCRM’s customer relationship management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to increase their privileges and compromise the confidentiality, integrity, and...

DEBIAN-CVE-2017-5981

seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service assertion failure and crash via a crafted ZIP file...

AZL-45219 CVE-2017-5974 affecting package zziplib for versions less than 0.13.74-1

Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

DEBIAN-CVE-2017-5979

The prescanentry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

AZL-43603 CVE-2017-5974 affecting package zziplib 0.13.72-3

Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

CVE-2017-5981

seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service assertion failure and crash via a crafted ZIP file...

CVE-2017-5977

The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP file...

CVE-2017-5980

The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

CVE-2017-5975

Heap-based buffer overflow in the zzipget64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via a crafted ZIP file...

DEBIAN-CVE-2017-5978

The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted ZIP file...

CVE-2017-5979

The prescanentry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP file...

Out-of-Bounds

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Out-of-Bounds. Heap-based buffer overflow in the zzipget32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a...

NULL Pointer Dereference

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The prescanentry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted ZIP...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. Heap-based buffer overflow in the zzipmementryextrablock function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service crash via ...

NULL Pointer Dereference

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted...

Out-of-bounds Read

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Out-of-bounds Read. The zzipmementryextrablock function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted ZIP...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service assertion failure and crash via a crafted ZIP file. Remediation There is no fixed version for zziplib. References - Blogs.gentoo.or...