The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4811-1 advisory.

  - The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows     remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in     zip_dirent.c) via a crafted ZIP archive. (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2858 advisory.

  - The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows     remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in     zip_dirent.c) via a crafted ZIP archive. (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 1.3.0, see https://nih.at/libzip/NEWS.html for details.

----

This update backports security fix for CVE-2017-14107.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 1.3.0**

It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. 

The changes are :

  - Support bzip2 compressed zip archives

  - Improve file progress callback code

  - Fix zip_fdopen()

  - CVE-2017-12858: Fix double free().

  - CVE-2017-14107: Improve EOCD64 parsing.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libzip developers report :

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

This update for libzip fixes one issues. This security issue was fixed :

  - CVE-2017-14107: The _zip_read_eocd64 function mishandled     EOCD records, which allowed remote attackers to cause a     denial of service (memory allocation failure in
    _zip_cdir_grow in zip_dirent.c) via a crafted ZIP     archive (bsc#1056996).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzip fixes the following security issue :

  - CVE-2017-14107: The _zip_read_eocd64 function mishandled     EOCD records, which allowed remote attackers to cause a     denial of service (memory allocation failure in
    _zip_cdir_grow in zip_dirent.c) via a crafted ZIP     archive (bsc#1056996).

This update was imported from the SUSE:SLE-12:Update update project.

This update fixes CVE-2017-14107.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libzip packages are available for Slackware 14.2 and -current to fix security issues.

ID	Name	Product	Family	Severity
183166	Ubuntu 16.04 ESM / 18.04 ESM : libzip vulnerability (USN-4811-1)	Nessus	Ubuntu Local Security Checks	medium
156328	Debian DLA-2858-1 : libzip - LTS security update	Nessus	Debian Local Security Checks	medium
105986	Fedora 27 : mingw-libzip (2017-d5487d0f80)	Nessus	Fedora Local Security Checks	medium
105913	Fedora 27 : libzip (2017-7bd193c0ed)	Nessus	Fedora Local Security Checks	critical
103481	FreeBSD : libzip -- denial of service (b2952517-07e5-4d19-8850-21c5b7e0623f)	Nessus	FreeBSD Local Security Checks	medium
103414	SUSE SLED12 / SLES12 Security Update : libzip (SUSE-SU-2017:2546-1)	Nessus	SuSE Local Security Checks	medium
103400	openSUSE Security Update : libzip (openSUSE-2017-1084)	Nessus	SuSE Local Security Checks	medium
103339	Fedora 25 : mingw-libzip (2017-bb5d87e9de)	Nessus	Fedora Local Security Checks	medium
103334	Fedora 26 : mingw-libzip (2017-4d4914a260)	Nessus	Fedora Local Security Checks	medium
103143	Slackware 14.2 / current : libzip (SSA:2017-255-02)	Nessus	Slackware Local Security Checks	medium
102984	Fedora 26 : libzip (2017-840db88351)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-14107

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

critical