CVE-2018-6381
Fixed in a distro release EPSS 2%
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.
Products: gdraheim zziplib, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | zziplib | 0.13.68-1 |
| Debian 12 | zziplib | 0.13.62-3.2 |
| Debian 13 | zziplib | 0.13.62-3.2 |
| Debian 14 | zziplib | 0.13.62-3.2 |
| Debian 8 | zziplib | 0.13.62-3+deb8u2 |
| SUSE Linux Enterprise Desktop 12 SP2 | zziplib | 0.13.67-10.5.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | zziplib | 0.13.67-10.5.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | zziplib | 0.13.67-10.5.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | zziplib | 0.13.67-10.5.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | zziplib | 0.13.67-10.5.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | zziplib | 0.13.67-10.5.1 |
| Ubuntu 14.04 LTS | zziplib | 0.13.62-2ubuntu0.2 |
| Ubuntu 16.04 LTS | zziplib | 0.13.62-3ubuntu0.16.04.2 |
| Ubuntu 18.04 LTS | zziplib | 0.13.62-3.1ubuntu0.18.04.1 |
| openSUSE Tumbleweed | zziplib | 0.13.72-1.4 |