Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2015:0668-1

Опубликовано: 20 мар. 2015
Источник: suse-cvrf

Описание

Security update for libzip

Libzip was updated to fix one security issue.

A zip file with an unusually large number of entries could have caused an integer overflow leading to a write past the heap boundary, crashing the application. (CVE-2015-2331 bnc#923240)

Список пакетов

SUSE Linux Enterprise Desktop 12
libzip2-0.11.1-6.1
SUSE Linux Enterprise Server 12
libzip2-0.11.1-6.1
SUSE Linux Enterprise Server for SAP Applications 12
libzip2-0.11.1-6.1
SUSE Linux Enterprise Software Development Kit 12
libzip-devel-0.11.1-6.1

Ссылки

Описание

Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

Затронутые продукты
SUSE Linux Enterprise Desktop 12:libzip2-0.11.1-6.1
SUSE Linux Enterprise Server 12:libzip2-0.11.1-6.1
SUSE Linux Enterprise Server for SAP Applications 12:libzip2-0.11.1-6.1
SUSE Linux Enterprise Software Development Kit 12:libzip-devel-0.11.1-6.1
Ссылки
Уязвимость SUSE-SU-2015:0668-1