CVE-2018-13410

2018-07-0600:00:00

ubuntu.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.2%

JSON

DISPUTED Info-ZIP Zip 3.0, when the -T and -TT command-line options
are used, allows attackers to cause a denial of service (invalid free and
application crash) or possibly have unspecified other impact because of an
off-by-one error. NOTE: it is unclear whether there are realistic scenarios
in which an untrusted party controls the -TT value, given that the entire
purpose of -TT is execution of arbitrary commands.

Notes

Author	Note
rodrigo-zaiden	suse does not have plans to fix it and debian marked as negligible. There is no obvious security impact since there is no scenarios where an untrusted party controls the -TT input value. Ubuntu is ignoring it as it is being disputed and there is no update as of 2022-02-01.