Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 628800 (CVE-2017-12858) - <dev-libs/libzip-1.2.0-r1: Double free in _zip_dirent_read function in zip_dirent.c (CVE-2017-12858)
Summary: <dev-libs/libzip-1.2.0-r1: Double free in _zip_dirent_read function in zip_di...
Status: RESOLVED FIXED
Alias: CVE-2017-12858
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on: CVE-2017-14107
Blocks:
  Show dependency tree
 
Reported: 2017-08-24 08:36 UTC by Agostino Sarubbo
Modified: 2017-10-28 13:09 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-08-24 08:36:44 UTC 
From ${URL} :

Double free vulnerability in the _zip_dirent_read function in
zip_dirent.c in libzip allows attackers to have unspecified impact via
unknown vectors.

Upstream patch:

https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Andreas Sturmlechner gentoo-dev 2017-08-24 17:18:15 UTC 
1.2.0-r1 security revbump added in git commit 8ae28c0fa697b98cc15aace97cf1668df29b5fd7
Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-08-24 17:52:21 UTC 
(In reply to Andreas Sturmlechner from comment #1)
> 1.2.0-r1 security revbump added in git commit
> 8ae28c0fa697b98cc15aace97cf1668df29b5fd7

Thank you, please feel free to call for stabilization when needed or let us know.

Gentoo Security Padawan
ChrisADR
Comment 3 Agostino Sarubbo gentoo-dev 2017-08-25 06:46:35 UTC 
I found another issue in libzip, let's wait a bit to avoid multiple stabilizations.
Comment 4 Andreas Sturmlechner gentoo-dev 2017-10-28 11:33:15 UTC 
See also bug 629574, cleanup done in git commit b4a9cb3e5493b414c2d671e6e5c1e8bcf084915c.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2017-10-28 13:09:03 UTC 
No PoC for ACE/RCE.

GLSA Vote: No