Detections
Analytics
openSUSE Security Update : zziplib (openSUSE-2017-554)
medium Nessus Plugin ID 100038
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
This update for zziplib fixes the following issues :Secuirty issues fixed :
- CVE-2017-5974: heap-based buffer overflow in
__zzip_get32 (fetch.c) (bsc#1024517)
- CVE-2017-5975: heap-based buffer overflow in
__zzip_get64 (fetch.c) (bsc#1024528)
- CVE-2017-5976: heap-based buffer overflow in zzip_mem_entry_extra_block (memdisk.c) (bsc#1024531)
- CVE-2017-5977: invalid memory read in zzip_mem_entry_extra_block (memdisk.c) (bsc#1024534)
- CVE-2017-5978: out of bounds read in zzip_mem_entry_new (memdisk.c) (bsc#1024533)
- CVE-2017-5979: NULL pointer dereference in prescan_entry (fseeko.c) (bsc#1024535)
- CVE-2017-5980: NULL pointer dereference in zzip_mem_entry_new (memdisk.c) (bsc#1024536)
- CVE-2017-5981: assertion failure in seeko.c (bsc#1024539)
- NULL pointer dereference in main (unzzipcat-mem.c) (bsc#1024532)
- NULL pointer dereference in main (unzzipcat.c) (bsc#1024537)
This update was imported from the SUSE:SLE-12:Update update project.
Solution
Update the affected zziplib packages.See Also
https://bugzilla.opensuse.org/show_bug.cgi?id=1024517
https://bugzilla.opensuse.org/show_bug.cgi?id=1024528
https://bugzilla.opensuse.org/show_bug.cgi?id=1024531
https://bugzilla.opensuse.org/show_bug.cgi?id=1024532
https://bugzilla.opensuse.org/show_bug.cgi?id=1024533
https://bugzilla.opensuse.org/show_bug.cgi?id=1024534
https://bugzilla.opensuse.org/show_bug.cgi?id=1024535
https://bugzilla.opensuse.org/show_bug.cgi?id=1024536
Plugin Details
Severity: Medium
ID: 100038
File Name: openSUSE-2017-554.nasl
Version: 3.4
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 5/9/2017
Updated: 1/19/2021
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:libzzip-0-13, p-cpe:/a:novell:opensuse:libzzip-0-13-32bit, p-cpe:/a:novell:opensuse:libzzip-0-13-debuginfo, p-cpe:/a:novell:opensuse:libzzip-0-13-debuginfo-32bit, p-cpe:/a:novell:opensuse:zziplib-debugsource, p-cpe:/a:novell:opensuse:zziplib-devel, p-cpe:/a:novell:opensuse:zziplib-devel-32bit, p-cpe:/a:novell:opensuse:zziplib-devel-debuginfo, p-cpe:/a:novell:opensuse:zziplib-devel-debuginfo-32bit, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Patch Publication Date: 5/8/2017
Reference Information
CVE: CVE-2017-5974, CVE-2017-5975, CVE-2017-5976, CVE-2017-5977, CVE-2017-5978, CVE-2017-5979, CVE-2017-5980, CVE-2017-5981