CVE-2018-6540 - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_

CVE-2018-6540

Summary

In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

References

Vulnerable Configurations

cpe:2.3:a:zziplib_project:zziplib:0.13.67:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.67:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

CVSS

Base:	4.3 (as of 28-06-2020 - 15:15)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

misc	https://github.com/gdraheim/zziplib/issues/15
mlist	[debian-lts-announce] 20200628 [SECURITY] [DLA 2258-1] zziplib security update
ubuntu	USN-3699-1

Last major update

28-06-2020 - 15:15

Published

02-02-2018 - 09:29

Last modified

28-06-2020 - 15:15