CVE-2015-2331

Publication date 30 March 2015

Last updated 24 July 2024

Ubuntu priority

Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libzip	15.10 wily	Not affected
	15.04 vivid	Ignored end of life
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Ignored end of life
php5	15.10 wily	Fixed 5.6.4+dfsg-4ubuntu4
	15.04 vivid	Fixed 5.6.4+dfsg-4ubuntu4
	14.10 utopic	Not affected
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not affected

Notes

mdeslaur

libzip in trusty and earlier doesn't support ZIP64, so doesn't look vulnerable. php5 in utopic and earlier doesn't support ZIP64 either.

sbeattie

fixed in libzip 1.0 release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libzip	Upstream: http://hg.nih.at/libzip/rev/9f11d54f692e
php5	Upstream: http://git.php.net/?p=php-src.git;a=commit;h=4a8d8b4154334b1714e19b82b061201d41dc87d6