Description
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
gdraheim zziplib
Default version status: unaffected
0 to ≤ 0.13.80affected
pkg:github/gdraheim/zziplibReferences
- https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-read ↗
- https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L420-L497 ↗
- https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L323-L352 ↗
- https://github.com/gdraheim/zziplib ↗
- https://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-disk-findfirst ↗