CVE-2017-5976 - Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.6

CVE-2017-5976

Summary

Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.

References

Vulnerable Configurations

cpe:2.3:a:zziplib_project:zziplib:0.13.56:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.56:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.57:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.57:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.58:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.58:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.59:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.59:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.60:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.60:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.61:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.61:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.62:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.62:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 31-03-2021 - 14:28)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	96268
debian	DSA-3878
misc	https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-zzip_mem_entry_extra_block-memdisk-c/
mlist	[oss-security] 20170214 Re: A note about the multiple crashes in zziplib

Last major update

31-03-2021 - 14:28

Published

01-03-2017 - 15:59

Last modified

31-03-2021 - 14:28