Vulnerabilities > CVE-2018-16548 - Missing Release of Resource after Effective Lifetime vulnerability in Zziplib Project Zziplib

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
zziplib-project
CWE-772
nessus

Summary

An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • HTTP DoS
    An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2750-1.NASL
    descriptionThis update for zziplib fixes the following issues : Security issue fixed : CVE-2018-16548: Prevented memory leak from __zzip_parse_root_directory(). Free allocated structure if its address is not passed back. (bsc#1107424) Other issue addressed: Prevented a division by zero (bsc#1129403). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id130195
    published2019-10-24
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130195
    titleSUSE SLED15 / SLES15 Security Update : zziplib (SUSE-SU-2019:2750-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:2750-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130195);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id("CVE-2018-16548");
    
      script_name(english:"SUSE SLED15 / SLES15 Security Update : zziplib (SUSE-SU-2019:2750-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for zziplib fixes the following issues :
    
    Security issue fixed :
    
    CVE-2018-16548: Prevented memory leak from
    __zzip_parse_root_directory(). Free allocated structure if its address
    is not passed back. (bsc#1107424)
    
    Other issue addressed: Prevented a division by zero (bsc#1129403).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1107424"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1129403"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-16548/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-20192750-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4acea3ee"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Module for Open Buildservice Development Tools
    15-SP1:zypper in -t patch
    SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2750=1
    
    SUSE Linux Enterprise Module for Open Buildservice Development Tools
    15:zypper in -t patch
    SUSE-SLE-Module-Development-Tools-OBS-15-2019-2750=1
    
    SUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch
    SUSE-SLE-Module-Basesystem-15-SP1-2019-2750=1
    
    SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch
    SUSE-SLE-Module-Basesystem-15-2019-2750=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libzzip-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libzzip-0-13");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libzzip-0-13-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libzzip-0-13-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:zziplib-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:zziplib-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:zziplib-devel-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:zziplib-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED15|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES15" && (! preg(pattern:"^(0|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0/1", os_ver + " SP" + sp);
    if (os_ver == "SLED15" && (! preg(pattern:"^(0|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0/1", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"libzzip-0-13-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"libzzip-0-13-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"zziplib-devel-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"1", reference:"zziplib-devel-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libzzip-0-13-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"libzzip-0-13-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"zziplib-devel-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLES15", sp:"0", reference:"zziplib-devel-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", cpu:"x86_64", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"libzzip-0-13-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"libzzip-0-13-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"zziplib-devel-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"1", reference:"zziplib-devel-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libzzip-0-13-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"libzzip-0-13-debuginfo-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"zziplib-debugsource-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"zziplib-devel-0.13.69-3.10.1")) flag++;
    if (rpm_check(release:"SLED15", sp:"0", reference:"zziplib-devel-debuginfo-0.13.69-3.10.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "zziplib");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2396.NASL
    descriptionThis update for zziplib fixes the following issues : Security issue fixed : - CVE-2018-16548: Prevented memory leak from __zzip_parse_root_directory(). Free allocated structure if its address is not passed back. (bsc#1107424) Other issue addressed : - Prevented a division by zero (bsc#1129403). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id130357
    published2019-10-29
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130357
    titleopenSUSE Security Update : zziplib (openSUSE-2019-2396)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-2396.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130357);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/17");
    
      script_cve_id("CVE-2018-16548");
    
      script_name(english:"openSUSE Security Update : zziplib (openSUSE-2019-2396)");
      script_summary(english:"Check for the openSUSE-2019-2396 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for zziplib fixes the following issues :
    
    Security issue fixed :
    
      - CVE-2018-16548: Prevented memory leak from
        __zzip_parse_root_directory(). Free allocated structure
        if its address is not passed back. (bsc#1107424)
    
    Other issue addressed :
    
      - Prevented a division by zero (bsc#1129403). This update
        was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1107424"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1129403"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected zziplib packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.1", reference:"libzzip-0-13-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libzzip-0-13-debuginfo-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"zziplib-debugsource-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"zziplib-devel-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"zziplib-devel-debuginfo-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-lp151.4.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-lp151.4.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libzzip-0-13 / libzzip-0-13-debuginfo / zziplib-debugsource / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2685.NASL
    descriptionAccording to the versions of the zziplib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.(CVE-2018-16548) - Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5974) - Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5975) - Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5976) - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6541) - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6540) - In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6484) - In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.(CVE-2018-6381) - In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6869) - seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.(CVE-2017-5981) - The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.(CVE-2017-5979) - The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.(CVE-2017-5977) - The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.(CVE-2017-5978) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-12-18
    plugin id132220
    published2019-12-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132220
    titleEulerOS 2.0 SP3 : zziplib (EulerOS-SA-2019-2685)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132220);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2017-5974",
        "CVE-2017-5975",
        "CVE-2017-5976",
        "CVE-2017-5977",
        "CVE-2017-5978",
        "CVE-2017-5979",
        "CVE-2017-5981",
        "CVE-2018-16548",
        "CVE-2018-6381",
        "CVE-2018-6484",
        "CVE-2018-6540",
        "CVE-2018-6541",
        "CVE-2018-6869"
      );
    
      script_name(english:"EulerOS 2.0 SP3 : zziplib (EulerOS-SA-2019-2685)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the zziplib package installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - An issue was discovered in ZZIPlib through 0.13.69.
        There is a memory leak triggered in the function
        __zzip_parse_root_directory in zip.c, which will lead
        to a denial of service attack.(CVE-2018-16548)
    
      - Heap-based buffer overflow in the __zzip_get32 function
        in fetch.c in zziplib 0.13.62 allows remote attackers
        to cause a denial of service (crash) via a crafted ZIP
        file.(CVE-2017-5974)
    
      - Heap-based buffer overflow in the __zzip_get64 function
        in fetch.c in zziplib 0.13.62 allows remote attackers
        to cause a denial of service (crash) via a crafted ZIP
        file.(CVE-2017-5975)
    
      - Heap-based buffer overflow in the
        zzip_mem_entry_extra_block function in memdisk.c in
        zziplib 0.13.62 allows remote attackers to cause a
        denial of service (crash) via a crafted ZIP
        file.(CVE-2017-5976)
    
      - In ZZIPlib 0.13.67, there is a bus error caused by
        loading of a misaligned address (when handling
        disk64_trailer local entries) in
        __zzip_fetch_disk_trailer (zzip/zip.c). Remote
        attackers could leverage this vulnerability to cause a
        denial of service via a crafted zip
        file.(CVE-2018-6541)
    
      - In ZZIPlib 0.13.67, there is a bus error caused by
        loading of a misaligned address in the
        zzip_disk_findfirst function of zzip/mmapped.c. Remote
        attackers could leverage this vulnerability to cause a
        denial of service via a crafted zip
        file.(CVE-2018-6540)
    
      - In ZZIPlib 0.13.67, there is a memory alignment error
        and bus error in the __zzip_fetch_disk_trailer function
        of zzip/zip.c. Remote attackers could leverage this
        vulnerability to cause a denial of service via a
        crafted zip file.(CVE-2018-6484)
    
      - In ZZIPlib 0.13.67, there is a segmentation fault
        caused by invalid memory access in the zzip_disk_fread
        function (zzip/mmapped.c) because the size variable is
        not validated against the amount of file->stored
        data.(CVE-2018-6381)
    
      - In ZZIPlib 0.13.68, there is an uncontrolled memory
        allocation and a crash in the
        __zzip_parse_root_directory function of zzip/zip.c.
        Remote attackers could leverage this vulnerability to
        cause a denial of service via a crafted zip
        file.(CVE-2018-6869)
    
      - seeko.c in zziplib 0.13.62 allows remote attackers to
        cause a denial of service (assertion failure and crash)
        via a crafted ZIP file.(CVE-2017-5981)
    
      - The prescan_entry function in fseeko.c in zziplib
        0.13.62 allows remote attackers to cause a denial of
        service (NULL pointer dereference and crash) via a
        crafted ZIP file.(CVE-2017-5979)
    
      - The zzip_mem_entry_extra_block function in memdisk.c in
        zziplib 0.13.62 allows remote attackers to cause a
        denial of service (invalid memory read and crash) via a
        crafted ZIP file.(CVE-2017-5977)
    
      - The zzip_mem_entry_new function in memdisk.c in zziplib
        0.13.62 allows remote attackers to cause a denial of
        service (out-of-bounds read and crash) via a crafted
        ZIP file.(CVE-2017-5978)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2685
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?48c509bf");
      script_set_attribute(attribute:"solution", value:
    "Update the affected zziplib packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-6869");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/18");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:zziplib");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["zziplib-0.13.62-9.h3"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "zziplib");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2394.NASL
    descriptionThis update for zziplib fixes the following issues : Security issue fixed : - CVE-2018-16548: Prevented memory leak from __zzip_parse_root_directory(). Free allocated structure if its address is not passed back. (bsc#1107424) Other issue addressed : - Prevented a division by zero (bsc#1129403). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id130355
    published2019-10-29
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130355
    titleopenSUSE Security Update : zziplib (openSUSE-2019-2394)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-2394.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130355);
      script_version("1.2");
      script_cvs_date("Date: 2019/12/17");
    
      script_cve_id("CVE-2018-16548");
    
      script_name(english:"openSUSE Security Update : zziplib (openSUSE-2019-2394)");
      script_summary(english:"Check for the openSUSE-2019-2394 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for zziplib fixes the following issues :
    
    Security issue fixed :
    
      - CVE-2018-16548: Prevented memory leak from
        __zzip_parse_root_directory(). Free allocated structure
        if its address is not passed back. (bsc#1107424)
    
    Other issue addressed :
    
      - Prevented a division by zero (bsc#1129403). This update
        was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1107424"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1129403"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected zziplib packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libzzip-0-13-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:zziplib-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"libzzip-0-13-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"libzzip-0-13-debuginfo-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"zziplib-debugsource-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"zziplib-devel-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"zziplib-devel-debuginfo-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libzzip-0-13-32bit-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"libzzip-0-13-32bit-debuginfo-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"zziplib-devel-32bit-0.13.69-lp150.7.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"zziplib-devel-32bit-debuginfo-0.13.69-lp150.7.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libzzip-0-13 / libzzip-0-13-debuginfo / zziplib-debugsource / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2478.NASL
    descriptionAccording to the versions of the zziplib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The zziplib is a lightweight library to easily extract data from zip files.Security Fix(es):An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.(CVE-2018-16548)In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.(CVE-2018-6381)In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6484)In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6540)In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6541)In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6869)The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.(CVE-2017-5979)seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.(CVE-2017-5981)The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.(CVE-2017-5978)Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5974)Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5976)Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.(CVE-2017-5975)The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.(CVE-2017-5977) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-12-04
    plugin id131631
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131631
    titleEulerOS 2.0 SP2 : zziplib (EulerOS-SA-2019-2478)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131631);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2017-5974",
        "CVE-2017-5975",
        "CVE-2017-5976",
        "CVE-2017-5977",
        "CVE-2017-5978",
        "CVE-2017-5979",
        "CVE-2017-5981",
        "CVE-2018-16548",
        "CVE-2018-6381",
        "CVE-2018-6484",
        "CVE-2018-6540",
        "CVE-2018-6541",
        "CVE-2018-6869"
      );
    
      script_name(english:"EulerOS 2.0 SP2 : zziplib (EulerOS-SA-2019-2478)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the zziplib package installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The zziplib is a lightweight library to easily extract
        data from zip files.Security Fix(es):An issue was
        discovered in ZZIPlib through 0.13.69. There is a
        memory leak triggered in the function
        __zzip_parse_root_directory in zip.c, which will lead
        to a denial of service attack.(CVE-2018-16548)In
        ZZIPlib 0.13.67, there is a segmentation fault caused
        by invalid memory access in the zzip_disk_fread
        function (zzip/mmapped.c) because the size variable is
        not validated against the amount of file->stored
        data.(CVE-2018-6381)In ZZIPlib 0.13.67, there is a
        memory alignment error and bus error in the
        __zzip_fetch_disk_trailer function of zzip/zip.c.
        Remote attackers could leverage this vulnerability to
        cause a denial of service via a crafted zip
        file.(CVE-2018-6484)In ZZIPlib 0.13.67, there is a bus
        error caused by loading of a misaligned address in the
        zzip_disk_findfirst function of zzip/mmapped.c. Remote
        attackers could leverage this vulnerability to cause a
        denial of service via a crafted zip
        file.(CVE-2018-6540)In ZZIPlib 0.13.67, there is a bus
        error caused by loading of a misaligned address (when
        handling disk64_trailer local entries) in
        __zzip_fetch_disk_trailer (zzip/zip.c). Remote
        attackers could leverage this vulnerability to cause a
        denial of service via a crafted zip
        file.(CVE-2018-6541)In ZZIPlib 0.13.68, there is an
        uncontrolled memory allocation and a crash in the
        __zzip_parse_root_directory function of zzip/zip.c.
        Remote attackers could leverage this vulnerability to
        cause a denial of service via a crafted zip
        file.(CVE-2018-6869)The prescan_entry function in
        fseeko.c in zziplib 0.13.62 allows remote attackers to
        cause a denial of service (NULL pointer dereference and
        crash) via a crafted ZIP file.(CVE-2017-5979)seeko.c in
        zziplib 0.13.62 allows remote attackers to cause a
        denial of service (assertion failure and crash) via a
        crafted ZIP file.(CVE-2017-5981)The zzip_mem_entry_new
        function in memdisk.c in zziplib 0.13.62 allows remote
        attackers to cause a denial of service (out-of-bounds
        read and crash) via a crafted ZIP
        file.(CVE-2017-5978)Heap-based buffer overflow in the
        __zzip_get32 function in fetch.c in zziplib 0.13.62
        allows remote attackers to cause a denial of service
        (crash) via a crafted ZIP
        file.(CVE-2017-5974)Heap-based buffer overflow in the
        zzip_mem_entry_extra_block function in memdisk.c in
        zziplib 0.13.62 allows remote attackers to cause a
        denial of service (crash) via a crafted ZIP
        file.(CVE-2017-5976)Heap-based buffer overflow in the
        __zzip_get64 function in fetch.c in zziplib 0.13.62
        allows remote attackers to cause a denial of service
        (crash) via a crafted ZIP file.(CVE-2017-5975)The
        zzip_mem_entry_extra_block function in memdisk.c in
        zziplib 0.13.62 allows remote attackers to cause a
        denial of service (invalid memory read and crash) via a
        crafted ZIP file.(CVE-2017-5977)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2478
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ae1e7e31");
      script_set_attribute(attribute:"solution", value:
    "Update the affected zziplib packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-6869");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:zziplib");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["zziplib-0.13.62-9.h3"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "zziplib");
    }
    
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0226_ZZIPLIB.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has zziplib packages installed that are affected by multiple vulnerabilities: - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. (CVE-2018-6541) - An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack. (CVE-2018-16548) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id132458
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132458
    titleNewStart CGSL CORE 5.05 / MAIN 5.05 : zziplib Multiple Vulnerabilities (NS-SA-2019-0226)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0226. The text
    # itself is copyright (C) ZTE, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(132458);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id("CVE-2018-6541", "CVE-2018-16548");
    
      script_name(english:"NewStart CGSL CORE 5.05 / MAIN 5.05 : zziplib Multiple Vulnerabilities (NS-SA-2019-0226)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has zziplib packages installed that are affected
    by multiple vulnerabilities:
    
      - In ZZIPlib 0.13.67, there is a bus error caused by
        loading of a misaligned address (when handling
        disk64_trailer local entries) in
        __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers
        could leverage this vulnerability to cause a denial of
        service via a crafted zip file. (CVE-2018-6541)
    
      - An issue was discovered in ZZIPlib through 0.13.69.
        There is a memory leak triggered in the function
        __zzip_parse_root_directory in zip.c, which will lead to
        a denial of service attack. (CVE-2018-16548)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0226");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL zziplib packages. Note that updated packages may not be available yet. Please contact ZTE
    for more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-6541");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/02/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.05" &&
        release !~ "CGSL MAIN 5.05")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.05 / NewStart CGSL MAIN 5.05');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.05": [
        "zziplib-0.13.62-11.el7",
        "zziplib-debuginfo-0.13.62-11.el7",
        "zziplib-devel-0.13.62-11.el7",
        "zziplib-utils-0.13.62-11.el7"
      ],
      "CGSL MAIN 5.05": [
        "zziplib-0.13.62-11.el7",
        "zziplib-debuginfo-0.13.62-11.el7",
        "zziplib-devel-0.13.62-11.el7",
        "zziplib-utils-0.13.62-11.el7"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "zziplib");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2236.NASL
    descriptionAccording to the versions of the zziplib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service.(CVE-2018-7725 ) - An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-7726) - An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of service attack.(CVE-2018-7727) - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6541) - An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.(CVE-2018-16548) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-08
    modified2019-11-08
    plugin id130698
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130698
    titleEulerOS 2.0 SP5 : zziplib (EulerOS-SA-2019-2236)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130698);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2018-16548",
        "CVE-2018-6541",
        "CVE-2018-7725",
        "CVE-2018-7726",
        "CVE-2018-7727"
      );
    
      script_name(english:"EulerOS 2.0 SP5 : zziplib (EulerOS-SA-2019-2236)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the zziplib package installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - An issue was discovered in ZZIPlib 0.13.68. An invalid
        memory address dereference was discovered in
        zzip_disk_fread in mmapped.c. The vulnerability causes
        an application crash, which leads to denial of
        service.(CVE-2018-7725 )
    
      - An issue was discovered in ZZIPlib 0.13.68. There is a
        bus error caused by the __zzip_parse_root_directory
        function of zip.c. Attackers could leverage this
        vulnerability to cause a denial of service via a
        crafted zip file.(CVE-2018-7726)
    
      - An issue was discovered in ZZIPlib 0.13.68. There is a
        memory leak triggered in the function zzip_mem_disk_new
        in memdisk.c, which will lead to a denial of service
        attack.(CVE-2018-7727)
    
      - In ZZIPlib 0.13.67, there is a bus error caused by
        loading of a misaligned address (when handling
        disk64_trailer local entries) in
        __zzip_fetch_disk_trailer (zzip/zip.c). Remote
        attackers could leverage this vulnerability to cause a
        denial of service via a crafted zip
        file.(CVE-2018-6541)
    
      - An issue was discovered in ZZIPlib through 0.13.69.
        There is a memory leak triggered in the function
        __zzip_parse_root_directory in zip.c, which will lead
        to a denial of service attack.(CVE-2018-16548)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2236
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51f34646");
      script_set_attribute(attribute:"solution", value:
    "Update the affected zziplib packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/08");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:zziplib");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["zziplib-0.13.62-11.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "zziplib");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20190806_ZZIPLIB_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - zziplib: Bus error caused by loading of a misaligned address inzzip/zip.c (CVE-2018-6541) - zziplib: Memory leak triggered in the function __zzip_parse_root_directory in zip.c (CVE-2018-16548)
    last seen2020-03-18
    modified2019-08-27
    plugin id128272
    published2019-08-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128272
    titleScientific Linux Security Update : zziplib on SL7.x x86_64 (20190806)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2019-2196.NASL
    descriptionAn update for zziplib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es) : * zziplib: Bus error caused by loading of a misaligned address inzzip/zip.c (CVE-2018-6541) * zziplib: Memory leak triggered in the function __zzip_parse_root_directory in zip.c (CVE-2018-16548) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id128374
    published2019-08-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128374
    titleCentOS 7 : zziplib (CESA-2019:2196)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2124.NASL
    descriptionAccording to the versions of the zziplib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.(CVE-2018-17828) - An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.(CVE-2018-16548) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-03
    modified2019-11-12
    plugin id130833
    published2019-11-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130833
    titleEulerOS 2.0 SP8 : zziplib (EulerOS-SA-2019-2124)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-3341-1.NASL
    descriptionThis update for zziplib fixes the following issues : Security issues fixed : CVE-2018-16548: Avoid a memory leak from __zzip_parse_root_directory() which could lead to denial of service. (bsc#1107424) CVE-2018-7727: Fixed a memory leak in unzzip_cat() (bsc#1084515). Non-security issue fixed: Prevented division by zero by first checking if uncompressed size is 0. This may happen with directories which have a compressed and uncompressed size of 0. (bsc#1129403) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id132335
    published2019-12-20
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132335
    titleSUSE SLED12 Security Update : zziplib (SUSE-SU-2019:3341-1)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0184_ZZIPLIB.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has zziplib packages installed that are affected by multiple vulnerabilities: - In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. (CVE-2018-6541) - An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack. (CVE-2018-16548) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id129933
    published2019-10-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129933
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : zziplib Multiple Vulnerabilities (NS-SA-2019-0184)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2196.NASL
    descriptionAn update for zziplib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es) : * zziplib: Bus error caused by loading of a misaligned address inzzip/zip.c (CVE-2018-6541) * zziplib: Memory leak triggered in the function __zzip_parse_root_directory in zip.c (CVE-2018-16548) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id127695
    published2019-08-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127695
    titleRHEL 7 : zziplib (RHSA-2019:2196)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1357.NASL
    descriptionAn issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.(CVE-2018-16548) In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.(CVE-2018-6541)
    last seen2020-06-01
    modified2020-06-02
    plugin id130608
    published2019-11-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130608
    titleAmazon Linux 2 : zziplib (ALAS-2019-1357)

Redhat

advisories
rhsa
idRHSA-2019:2196
rpms
  • zziplib-0:0.13.62-11.el7
  • zziplib-debuginfo-0:0.13.62-11.el7
  • zziplib-devel-0:0.13.62-11.el7
  • zziplib-utils-0:0.13.62-11.el7