CVE-2017-14107

Published: 01 September 2017

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

From the Ubuntu security team

It was discovered that libzip mishandled certain malformed ZIP archives. An attacker could use this vulnerability to cause a denial of service.

Priority

Low

CVSS 3 base score: 6.5

Status

Package Release Status
libzip
Launchpad, Ubuntu, Debian
Upstream
Released (1.3.0+dfsg.1-1)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(1.5.1-0ubuntu1)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(1.5.1-0ubuntu1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(1.5.1-0ubuntu1)
Ubuntu 18.04 LTS (Bionic Beaver) Needed

Ubuntu 16.04 ESM (Xenial Xerus) Ignored
(end of standard support, was needed)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(code not present)
Patches:
Upstream: https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5
php5
Launchpad, Ubuntu, Debian
Upstream
Released (5.6.33+dfsg-0+deb8u1)
Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(code not present)
Patches:
Upstream: https://github.com/php/php-src/commit/f6e8ce812174343b5c9fd1860f9e2e2864428567