[arch-security] [ASA-201705-15] zziplib: multiple issues

[Santiago Torres-Arias]

Arch Linux Security Advisory ASA-201705-15
==========================================

Severity: High
Date    : 2017-05-12
CVE-ID  : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979
          CVE-2017-5981
Package : zziplib
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-191

Summary
=======

The package zziplib before version 0.13.66-2 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
==========

Upgrade to 0.13.66-2.

# pacman -Syu "zziplib>=0.13.66-2"

The problems have been fixed upstream in version 0.13.66.

Workaround
==========

None.

Description
===========

- CVE-2017-5974 (arbitrary code execution)

Heap-based buffer overflow in the __zzip_get32 function in fetch.c in
zziplib 0.13.62 allows remote attackers to cause a denial of service
(crash) via a crafted ZIP file.

- CVE-2017-5975 (arbitrary code execution)

Heap-based buffer overflow in the __zzip_get64 function in fetch.c in
zziplib 0.13.62 allows remote attackers to cause a denial of service
(crash) via a crafted ZIP file.

- CVE-2017-5976 (arbitrary code execution)

Heap-based buffer overflow in the zzip_mem_entry_extra_block function
in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a
denial of service (crash) via a crafted ZIP file.

- CVE-2017-5979 (denial of service)

The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote
attackers to cause a denial of service (NULL pointer dereference and
crash) via a crafted ZIP file.

- CVE-2017-5981 (denial of service)

seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of
service (assertion failure and crash) via a crafted ZIP file.

Impact
======

A remote attacker is able to crash the target process or execute
arbitrary code on the host by providing a malicious file.

References
==========

https://bugs.archlinux.org/task/53133
http://www.openwall.com/lists/oss-security/2017/02/14/3
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get32-fetch-c/
https://github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42cdb184cd1
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-__zzip_get64-fetch-c/
https://github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e142ce03dd7
https://github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994dc2ca5734
https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-in-zzip_mem_entry_extra_block-memdisk-c/
https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in-prescan_entry-fseeko-c/
https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-c/
https://github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd9d6bc286
https://github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0e1bc806b
https://security.archlinux.org/CVE-2017-5974
https://security.archlinux.org/CVE-2017-5975
https://security.archlinux.org/CVE-2017-5976
https://security.archlinux.org/CVE-2017-5979
https://security.archlinux.org/CVE-2017-5981
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170512/c87a6326/attachment.asc>