CVE-2012-1163 - Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers

CVE-2012-1163

Summary

Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.

References

Vulnerable Configurations

cpe:2.3:a:nih:libzip:0.10:*:*:*:*:*:*:*
cpe:2.3:a:nih:libzip:0.10:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 16-07-2012 - 04:00)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm	http://www.nih.at/libzip/NEWS.html
gentoo	GLSA-201203-23
mandriva	MDVSA-2012:034
mlist	[libzip-discuss] 20120320 libzip-0.10.1 security fix release [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip

Last major update

16-07-2012 - 04:00

Published

12-07-2012 - 20:55

Last modified

16-07-2012 - 04:00