Your submission was sent successfully! Close

CVE-2017-14107

Published: 1 September 2017

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

From the Ubuntu Security Team

It was discovered that libzip mishandled certain malformed ZIP archives. An attacker could use this vulnerability to cause a denial of service.

Priority

Low

CVSS 3 base score: 6.5

Status

Package Release Status
libzip
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Not vulnerable
(1.5.1-0ubuntu1)
eoan Not vulnerable
(1.5.1-0ubuntu1)
focal Not vulnerable
(1.5.1-0ubuntu1)
groovy Not vulnerable
(1.5.1-0ubuntu1)
hirsute Not vulnerable
(1.5.1-0ubuntu1)
impish Not vulnerable
(1.5.1-0ubuntu1)
jammy Not vulnerable
(1.5.1-0ubuntu1)
kinetic Not vulnerable
(1.5.1-0ubuntu1)
precise Does not exist

trusty Not vulnerable
(code not present)
upstream
Released (1.3.0+dfsg.1-1, 1.3.0)
xenial Ignored
(end of standard support, was needed)
zesty Ignored
(reached end-of-life)
Patches:
upstream: https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5

php5
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Not vulnerable
(code not present)
trusty Not vulnerable
(code not present)
upstream
Released (5.6.33+dfsg-0+deb8u1)
xenial Does not exist

zesty Ignored
(reached end-of-life)
Patches:

upstream: https://github.com/php/php-src/commit/f6e8ce812174343b5c9fd1860f9e2e2864428567