| Summary: | <dev-libs/zziplib-0.13.69-r1: multiple vulnerabilities (CVE-2017-{5974,5975,5976,5977,5978,5979,5980,5981}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | mr_bones_, teika, vapier |
| Priority: | Normal | Keywords: | PullRequest |
| Version: | unspecified | Flags: | stable-bot:
sanity-check+
|
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: | https://github.com/gentoo/gentoo/pull/14985 | ||
| Whiteboard: | B3 [noglsa cve] | ||
| Package list: |
dev-libs/zziplib-0.13.69-r1
|
Runtime testing required: | --- |
| Bug Depends on: | 646780 | ||
| Bug Blocks: | |||
|
Description
Agostino Sarubbo
2017-03-27 09:34:31 UTC
Debian already released a fixed version: https://www.debian.org/security/2017/dsa-3878 The list of the CVEs are: CVE-2017-5974, CVE-2017-5975, CVE-2017-5976, CVE-2017-5978, CVE-2017-5979, CVE-2017-5980, CVE-2017-5981. CVE-2017-5974 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5974): Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. CVE-2017-5975 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5975): Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. CVE-2017-5976 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5976): Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. CVE-2017-5977 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5977): The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file. CVE-2017-5978 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5978): The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file. CVE-2017-5979 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5979): The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. CVE-2017-5980 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5980): The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. CVE-2017-5981 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5981): seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. (In reply to Teika kazura from comment #1) > Debian already released a fixed version: > https://www.debian.org/security/2017/dsa-3878 Not all vulnerabilities are fixed yet, even in Debian's release. See https://security-tracker.debian.org/tracker/CVE-2017-5977 for example. Not sure if I should open another bug entry but as this one isn't resolved: I also found out that there is at least CVE-2018-17828 ( Fixed with https://github.com/gdraheim/zziplib/commit/81dfa6b3e08f6934885ba5c98939587d6850d08e ) too while browsing their github. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7ec605c4b65aee2fa1981227c221502063c252d4 commit 7ec605c4b65aee2fa1981227c221502063c252d4 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2020-01-17 02:32:16 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2020-01-17 02:38:35 +0000 dev-libs/zziplib: Fix multiple security vulnerabilities - CVE-2018-7725 - CVE-2018-7726 - CVE-2018-16548 - CVE-2018-17828 Patches fetched from openSUSE, many thanks. Bug: https://bugs.gentoo.org/614040 Package-Manager: Portage-2.3.84, Repoman-2.3.20 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> dev-libs/zziplib/Manifest | 1 + dev-libs/zziplib/zziplib-0.13.69-r1.ebuild | 6 ++---- 2 files changed, 3 insertions(+), 4 deletions(-) Please note that patches for CVE-2018-7725 and CVE-2018-7726 apply cleanly even though those CVEs were claimed to be fixed in bug 646780. Arches, please stabilise. Security, please decide what to do here (either update the bug with new CVEs or open a new one depending on this one). amd64 stable ppc64 stable ppc stable sparc stable ia64 stable x86 stable hppa stable arm stable s390 stable arm64 stable @ maintainer(s): Please cleanup and drop =dev-libs/zziplib-0.13.69! The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f04160d12ea709df577a3829e093bd3e7aae928 commit 8f04160d12ea709df577a3829e093bd3e7aae928 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2020-03-16 23:38:49 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2020-03-16 23:38:58 +0000 dev-libs/zziplib: Cleanup vulnerable 0.13.69 (r0) Bug: https://bugs.gentoo.org/614040 Package-Manager: Portage-2.3.94, Repoman-2.3.21 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> dev-libs/zziplib/zziplib-0.13.69.ebuild | 92 --------------------------------- 1 file changed, 92 deletions(-) GLSA Vote: No! Repository is clean, all done! |