Arch Linux Security Advisory ASA-201705-15 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979 CVE-2017-5981 Package : zziplib Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-191 Summary ======= The package zziplib before version 0.13.66-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.13.66-2. # pacman -Syu "zziplib>=0.13.66-2" The problems have been fixed upstream in version 0.13.66. Workaround ========== None. Description =========== - CVE-2017-5974 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5975 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5976 (arbitrary code execution) Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5979 (denial of service) The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. - CVE-2017-5981 (denial of service) seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. Impact ====== A remote attacker is able to crash the target process or execute arbitrary code on the host by providing a malicious file. References ========== https://bugs.archlinux.org/task/53133 http://www.openwall.com/lists/oss-security/2017/02/14/3 https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-i... https://github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42cd... https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-i... https://github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e142... https://github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994dc... https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-i... https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-... https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-c... https://github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd9... https://github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0e... https://security.archlinux.org/CVE-2017-5974 https://security.archlinux.org/CVE-2017-5975 https://security.archlinux.org/CVE-2017-5976 https://security.archlinux.org/CVE-2017-5979 https://security.archlinux.org/CVE-2017-5981