Summary
It was discovered that zziplib incorrectly handled certain malformed ZIP
files. If a user or automated system were tricked into opening a specially
crafted ZIP file, a remote attacker could cause zziplib to crash, resulting
in a denial of service, or possibly execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | zziplib | 0.13.62-2ubuntu0.2 |
| Ubuntu · 16.04 LTS 16.04:LTS | zziplib | 0.13.62-3ubuntu0.16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | zziplib | 0.13.62-3.1ubuntu0.18.04.1 |
Vulnerabilities 7
-
Unscored —
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.5…
-
Unscored —
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/z…
-
Unscored —
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function …
-
Unscored —
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local …
-
Unscored —
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function …
-
Unscored —
An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in …
-
Unscored —
An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of …
References
-
report
https://ubuntu.com/security/CVE-2018-6381
-
report
https://ubuntu.com/security/CVE-2018-6484
-
report
https://ubuntu.com/security/CVE-2018-6540
-
report
https://ubuntu.com/security/CVE-2018-6541
-
report
https://ubuntu.com/security/CVE-2018-6869
-
report
https://ubuntu.com/security/CVE-2018-7725
-
report
https://ubuntu.com/security/CVE-2018-7726