Description
Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libzip | 1.8.0-1.2 | openSUSE-SU-2024:11018-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.6 | libzip | 1.2.0-r2 | — |
Advisories 1
- openSUSE-SU-2024:11018-1 libzip-devel-1.8.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026