Heap-based buffer overflow in zziplib
Summary
DLA-994-1: zziplib - security update. Affects zziplib versions < 0.13.56-1.1+deb7u1. Fixed in 0.13.56-1.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
zziplib is a library for reading and writing ZIP archives. It provides functions for extracting files from ZIP archives and creating new ZIP archives. The library is widely used in various applications that handle ZIP files. However, zziplib is vulnerable to a heap-based buffer overflow, which can be exploited by remote attackers to cause a denial of service (crash) by sending a crafted ZIP file.
Vulnerability Detail
The vulnerability in zziplib is caused by several heap-based buffer overflows in different functions within the library. These overflows can be triggered by processing a specially crafted ZIP file. By exploiting these vulnerabilities, remote attackers can cause a denial of service by crashing the application that uses zziplib. The specific functions affected by the buffer overflows are __zzip_get32, __zzip_get64, zzip_mem_entry_extra_block, zzip_mem_entry_new, prescan_entry, and seeko. Each of these functions can be exploited to crash the application in different ways, such as through a NULL pointer dereference or an assertion failure.
How To Fix
Minimum fixed version
0.13.56-1.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zziplibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
zziplib is vulnerable to heap-based buffer overflows that can be exploited by remote attackers to cause a denial of service. It is crucial to update to the latest version of zziplib (0.13.56-1.1+deb7u1) to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zziplib →
FAQ
zziplib is a library for reading and writing ZIP archives. It provides functions for extracting files from ZIP archives and creating new ZIP archives.
A heap-based buffer overflow is a type of vulnerability where a program writes more data into a buffer in the heap memory than it can hold. This can lead to memory corruption and can be exploited by attackers to execute arbitrary code or crash the program.
The zziplib vulnerabilities can be exploited by sending a specially crafted ZIP file to an application that uses the zziplib library. By triggering the heap-based buffer overflows in the library, remote attackers can cause a denial of service by crashing the application.
The impact of these vulnerabilities is a denial of service, as the application using the zziplib library will crash when processing the specially crafted ZIP file. This can lead to disruption of service and potential data loss.
To protect your application from these vulnerabilities, it is recommended to upgrade to the latest version of zziplib (0.13.56-1.1+deb7u1). This version includes patches that fix the heap-based buffer overflows. Additionally, it is important to keep your software and libraries up to date and follow secure coding practices to minimize the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for zziplib.
