CVE-2019-13453 - Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infin

CVE-2019-13453

Summary

Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().

References

Vulnerable Configurations

cpe:2.3:a:zipios_project:zipios:0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:zipios_project:zipios:0.1.5:*:*:*:*:*:*:*
cpe:2.3:a:zipios_project:zipios:0.1.6:*:*:*:*:*:*:*
cpe:2.3:a:zipios_project:zipios:0.1.6:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 02-06-2022 - 14:15)
Impact:
Exploitability:

CWE

CWE-835

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	109282
confirm	https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/
misc	https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/

Last major update

02-06-2022 - 14:15

Published

17-07-2019 - 15:15

Last modified

02-06-2022 - 14:15