Bug 602048 (CVE-2016-9844)

Summary:

<app-arch/unzip-6.0_p21-r2: buffer overflow in ZipInfo (CVE-2016-9844)

Product:

Gentoo Security

Reporter:

Ian Zimmerman <nobrowser>

Component:

Vulnerabilities

Assignee:

Gentoo Security <security>

Status:

RESOLVED FIXED

Severity:

normal

CC:

base-system, slawomir.nizio

Priority:

Normal

Version:

unspecified

Hardware:

All

OS:

Linux

URL:

http://www.openwall.com/lists/oss-security/2016/12/05/13

Whiteboard:

A4 [noglsa cve]

Package list:

Runtime testing required:

---

Attachments:

Description	Flags
patch constrcuted according to the discussion on oss-security	none

Description Ian Zimmerman 2016-12-08 23:42:14 UTC

According to the posting on oss-security [1]:

Alexis Vanden Eijnde has discovered a zipinfo buffer overflow...

I shall attach a patch (constructed locally because upstream has no public VCS) after I submit this report.

[1]
https://marc.info/?l=oss-security&m=148095466614279&w=2


Reproducible: Always

Comment 1 Ian Zimmerman 2016-12-08 23:43:49 UTC

Created attachment 455550 [details, diff]
patch constrcuted according to the discussion on oss-security

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2019-03-30 01:35:22 UTC

Patch is in the Debian patchset which Gentoo ships:

19-cve-2016-9844-zipinfo-buffer-overflow.patch

Comment 3 Aaron Bauman (RETIRED) gentoo-dev

2019-05-01 02:59:26 UTC

@base-system, please clean vulnerable