CVE-2020-18442
Fixed in a distro release EPSS <1%
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
Products: gdraheim zziplib, debian_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | zziplib | 0.13.68-9.el8 |
| AlmaLinux 8 | zziplib-devel | 0.13.68-9.el8 |
| AlmaLinux 8 | zziplib-utils | 0.13.68-9.el8 |
| Amazon Linux 2023 | zziplib | 0.13.72-1.amzn2023.0.3 |
| Amazon Linux 2023 | zziplib-devel | 0.13.72-1.amzn2023.0.3 |
| Amazon Linux 2023 | zziplib-utils | 0.13.72-1.amzn2023.0.3 |
| Debian 12 | zziplib | 0.13.72+dfsg.1-1 |
| Debian 13 | zziplib | 0.13.72+dfsg.1-1 |
| Debian 14 | zziplib | 0.13.72+dfsg.1-1 |
| Debian 9 | zziplib | 0.13.62-3.2~deb9u2 |
| Red Hat Enterprise Linux 8 | zziplib | 0:0.13.68-9.el8 |
| Red Hat Enterprise Linux 8 | zziplib-debuginfo | 0:0.13.68-9.el8 |
| Red Hat Enterprise Linux 8 | zziplib-debugsource | 0:0.13.68-9.el8 |
| Red Hat Enterprise Linux 8 | zziplib-devel | 0:0.13.68-9.el8 |
| Red Hat Enterprise Linux 8 | zziplib-utils | 0:0.13.68-9.el8 |
| Red Hat Enterprise Linux 8 | zziplib-utils-debuginfo | 0:0.13.68-9.el8 |
| Rocky Linux 8 | zziplib | 0:0.13.68-9.el8 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | zziplib | 0.13.69-150000.3.17.1 |
| SUSE Linux Enterprise Server 15 SP4-TERADATA | zziplib | 0.13.69-150000.3.17.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | zziplib | 0.13.67-10.33.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP5 | zziplib | 0.13.67-10.33.1 |
| Ubuntu 20.04 LTS | zziplib | 0.13.62-3.2ubuntu1.1 |
| Ubuntu Pro 16.04 LTS | zziplib | 0.13.62-3ubuntu0.16.04.2+esm1 |
| Ubuntu Pro 18.04 LTS | zziplib | 0.13.62-3.1ubuntu0.18.04.1+esm1 |
| openSUSE Leap 15.5 | zziplib | 0.13.69-150000.3.17.1 |