CVE-2018-7726
Fixed in a distro release EPSS 2%
An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Products: gdraheim zziplib, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | zziplib | 0.13.62-9.amzn2 |
| Amazon Linux 2 | zziplib-devel | 0.13.62-9.amzn2 |
| Amazon Linux 2 | zziplib-utils | 0.13.62-9.amzn2 |
| Arch Linux | zziplib | 0.13.69-1 |
| Debian 12 | zziplib | 0.13.62-3.2 |
| Debian 13 | zziplib | 0.13.62-3.2 |
| Debian 14 | zziplib | 0.13.62-3.2 |
| Debian 8 | zziplib | 0.13.62-3+deb8u2 |
| Red Hat Enterprise Linux 7 | zziplib | 0:0.13.62-9.el7 |
| Red Hat Enterprise Linux 7 | zziplib-debuginfo | 0:0.13.62-9.el7 |
| Red Hat Enterprise Linux 7 | zziplib-devel | 0:0.13.62-9.el7 |
| Red Hat Enterprise Linux 7 | zziplib-utils | 0:0.13.62-9.el7 |
| SUSE Linux Enterprise Desktop 12 SP3 | zziplib | 0.13.67-10.8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | zziplib | 0.13.67-10.8.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | zziplib | 0.13.67-10.8.1 |
| Ubuntu 14.04 LTS | zziplib | 0.13.62-2ubuntu0.2 |
| Ubuntu 16.04 LTS | zziplib | 0.13.62-3ubuntu0.16.04.2 |
| Ubuntu 18.04 LTS | zziplib | 0.13.62-3.1ubuntu0.18.04.1 |
| openSUSE Tumbleweed | zziplib | 0.13.72-1.4 |