Bug 49378 - zziplib: Multiple issues (4.4)
zziplib: Multiple issues (4.4)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.4
All Linux
: P3 normal (vote)
: UCS 4.4-0-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-04-29 08:32 CEST by Quality Assurance
Modified: 2019-05-02 13:22 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2019-04-29 08:32:31 CEST
New Debian zziplib 0.13.62-3.2~deb9u1 fixes:
This update addresses the following issues:
* Invalid memory access in the zzip_disk_fread function in zzip/mmapped.c  (CVE-2018-6381)
* Loading of misaligned memory address in zip.c:__zzip_fetch_disk_trailer can  lead to a denial of service via crafted zip file (CVE-2018-6484)
* bus error in zzip_disk_findfirst function in zzip/mmapped.c (CVE-2018-6540)
* bus error caused by loading of a misaligned address inzzip/zip.c  (CVE-2018-6541)
* uncontrolled memory allocation in __zzip_parse_root_directory in zzip/zip.c  (CVE-2018-6869)
* out of bound read in mmapped.c:zzip_disk_fread() causes crash  (CVE-2018-7725)
* Bus error in zip.c:__zzip_parse_root_directory() cause crash via crafted  zip file (CVE-2018-7726)
* Memory leak triggered in the function __zzip_parse_root_directory in zip.c  (CVE-2018-16548)
Comment 1 Quality Assurance univentionstaff 2019-04-29 15:01:49 CEST
--- mirror/ftp/4.3/unmaintained/4.3-0/source/zziplib_0.13.62-3.1.dsc
+++ apt/ucs_4.4-0-errata4.4-0/source/zziplib_0.13.62-3.2~deb9u1.dsc
@@ -1,3 +1,24 @@
+0.13.62-3.2~deb9u1 [Sun, 31 Mar 2019 22:02:00 +0200] Salvatore Bonaccorso <carnil@debian.org>:
+
+  * Rebuild for stretch.
+
+0.13.62-3.2 [Mon, 04 Mar 2019 22:43:14 +0100] Salvatore Bonaccorso <carnil@debian.org>:
+
+  * Non-maintainer upload.
+  * Invalid memory access in zzip_disk_fread (CVE-2018-6381) (Closes: #889096)
+  * Reject the ZIP file and report it as corrupt if the size of the central
+    directory and/or the offset of start of central directory point beyond the
+    end of the ZIP file (CVE-2018-6484, CVE-2018-6541, CVE-2018-6869)
+    (Closes: #889089)
+  * bus error in zzip_disk_findfirst function in zzip/mmapped.c
+    (CVE-2018-6540) (Closes: #923659)
+  * out of bound read in mmapped.c:zzip_disk_fread() causes crash
+    (CVE-2018-7725) (Closes: #913165)
+  * Bus error in zip.c:__zzip_parse_root_directory() cause crash via crafted
+    zip file (CVE-2018-7726) (Closes: #913165)
+  * Memory leak triggered in the function __zzip_parse_root_directory in zip.c
+    (CVE-2018-16548) (Closes: #910335)
+
 0.13.62-3.1 [Sun, 04 Jun 2017 09:03:20 +0200] Moritz Muehlenhoff <jmm@debian.org>:
 
   * Non-maintainer upload.

<http://10.200.17.11/4.4-0/#8328939731133714812>
Comment 2 Philipp Hahn univentionstaff 2019-04-29 16:07:06 CEST
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.4-0] eaa7ec6a95 Bug #49378: zziplib 0.13.62-3.2~deb9u1
 doc/errata/staging/zziplib.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

[4.4-0] 5b24cf887a Bug #49378: zziplib 0.13.62-3.2~deb9u1
 doc/errata/staging/zziplib.yaml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
Comment 3 Arvid Requate univentionstaff 2019-05-02 13:22:41 CEST
<http://errata.software-univention.de/ucs/4.4/74.html>