Skip to content
OpenAdvisories
Medium ALAS2023-2025-859 2 CVEs

Moderate: zziplib security update (Amazon Linux 2023)

Published Feb 12, 2025 · Updated Feb 21, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-39134: A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c. CVE-2024-39133: Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 zziplib 0:0.13.78-1.amzn2023
Amazon Linux · 2023 zziplib-debuginfo 0:0.13.78-1.amzn2023
Amazon Linux · 2023 zziplib-debugsource 0:0.13.78-1.amzn2023
Amazon Linux · 2023 zziplib-devel 0:0.13.78-1.amzn2023
Amazon Linux · 2023 zziplib-utils 0:0.13.78-1.amzn2023
Amazon Linux · 2023 zziplib-utils-debuginfo 0:0.13.78-1.amzn2023

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39133.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39134.html