CVE-2017-5979 - The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial

CVE-2017-5979

Summary

The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.

References

http://www.debian.org/security/2017/dsa-3878
http://www.securityfocus.com/bid/96268
https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/

Vulnerable Configurations

cpe:2.3:a:zziplib_project:zziplib:0.13.62:*:*:*:*:*:*:*
cpe:2.3:a:zziplib_project:zziplib:0.13.62:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 04-11-2017 - 01:29)
Impact:
Exploitability:

CWE

CWE-476

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

bid	96268
debian	DSA-3878
misc	https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/

Last major update

04-11-2017 - 01:29

Published

01-03-2017 - 15:59

Last modified

04-11-2017 - 01:29