The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libzip: Memory allocation failure in _zip_cdir_grow function (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libzip: Memory allocation failure in _zip_cdir_grow function (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

New libzip packages are available for Slackware 14.2 and -current to fix security issues.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4811-1 advisory.

  - The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows     remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in     zip_dirent.c) via a crafted ZIP archive. (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

**Version 1.3.0**

It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. 

The changes are :

  - Support bzip2 compressed zip archives

  - Improve file progress callback code

  - Fix zip_fdopen()

  - CVE-2017-12858: Fix double free().

  - CVE-2017-14107: Improve EOCD64 parsing.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzip fixes one issues. This security issue was fixed :

  - CVE-2017-14107: The _zip_read_eocd64 function mishandled     EOCD records, which allowed remote attackers to cause a     denial of service (memory allocation failure in
    _zip_cdir_grow in zip_dirent.c) via a crafted ZIP     archive (bsc#1056996).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libzip developers report :

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

This update fixes CVE-2017-14107.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2858 advisory.

  - The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows     remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in     zip_dirent.c) via a crafted ZIP archive. (CVE-2017-14107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to version 1.3.0, see https://nih.at/libzip/NEWS.html for details.

----

This update backports security fix for CVE-2017-14107.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libzip fixes the following security issue :

  - CVE-2017-14107: The _zip_read_eocd64 function mishandled     EOCD records, which allowed remote attackers to cause a     denial of service (memory allocation failure in
    _zip_cdir_grow in zip_dirent.c) via a crafted ZIP     archive (bsc#1056996).

This update was imported from the SUSE:SLE-12:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
196176	RHEL 6 : libzip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	medium
196159	RHEL 7 : libzip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	medium
103143	Slackware 14.2 / current : libzip (SSA:2017-255-02)	Nessus	Slackware Local Security Checks	9/13/2017	1/14/2021	medium
183166	Ubuntu 16.04 ESM / 18.04 ESM : libzip vulnerability (USN-4811-1)	Nessus	Ubuntu Local Security Checks	10/16/2023	10/16/2023	medium
102984	Fedora 26 : libzip (2017-840db88351)	Nessus	Fedora Local Security Checks	9/7/2017	1/6/2021	critical
103414	SUSE SLED12 / SLES12 Security Update : libzip (SUSE-SU-2017:2546-1)	Nessus	SuSE Local Security Checks	9/22/2017	1/6/2021	medium
103481	FreeBSD : libzip -- denial of service (b2952517-07e5-4d19-8850-21c5b7e0623f)	Nessus	FreeBSD Local Security Checks	9/27/2017	1/4/2021	medium
103339	Fedora 25 : mingw-libzip (2017-bb5d87e9de)	Nessus	Fedora Local Security Checks	9/20/2017	1/6/2021	medium
156328	Debian DLA-2858-1 : libzip - LTS security update	Nessus	Debian Local Security Checks	12/28/2021	12/28/2021	medium
105986	Fedora 27 : mingw-libzip (2017-d5487d0f80)	Nessus	Fedora Local Security Checks	1/15/2018	1/6/2021	medium
103334	Fedora 26 : mingw-libzip (2017-4d4914a260)	Nessus	Fedora Local Security Checks	9/20/2017	1/6/2021	medium
103400	openSUSE Security Update : libzip (openSUSE-2017-1084)	Nessus	SuSE Local Security Checks	9/22/2017	1/19/2021	medium
105913	Fedora 27 : libzip (2017-7bd193c0ed)	Nessus	Fedora Local Security Checks	1/15/2018	1/6/2021	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

critical