Description
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libzip | 0.10.1-1 | — |
| Debian 13 | libzip | 0.10.1-1 | — |
| Debian 12 | libzip | 0.10.1-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libzip | 1.1.3-1.4 | openSUSE-SU-2024:10113-1 |
Advisories 1
- openSUSE-SU-2024:10113-1 libzip-devel-1.1.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [libzip-discuss] 20120320 libzip-0.10.1 security fix release mailing-list
- [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip mailing-list
- MDVSA-2012:034 vendor-advisory
- http://www.nih.at/libzip/NEWS.html
- [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip mailing-list
- GLSA-201203-23 vendor-advisory