CVE-2017-14107

Опубликовано: 01 сент. 2017

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

Ссылки

https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/
Patch
Third Party Advisory
VDB Entry
https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html
Mailing List
Third Party Advisory
https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/
Patch
Third Party Advisory
VDB Entry
https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libzip:libzip:*:*:*:*:*:*:*:*

Версия до 1.3.0 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01055

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-770

Связанные уязвимости

CVE-2017-14107

CVSS3: 6.5

ubuntu

больше 8 лет назад

CVE-2017-14107

CVSS3: 3.3

redhat

больше 8 лет назад

CVE-2017-14107

CVSS3: 6.5

debian

больше 8 лет назад

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mis ...

openSUSE-SU-2017:2550-1

suse-cvrf

больше 8 лет назад

Security update for libzip

SUSE-SU-2017:2546-1

suse-cvrf

больше 8 лет назад

Security update for libzip

EPSS

Процентиль: 77%

0.01055

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-770