Bug 1484514 (CVE-2017-12858)

Summary:	CVE-2017-12858 libzip: Double free in _zip_dirent_read function in zip_dirent.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	erik-fedora, fedora, hhorak, jchaloup, jorton, manisandro, rcollet, rdieter, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libzip 1.3.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:22:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1484515, 1484516
Bug Blocks:

Description Pedro Sampaio 2017-08-23 18:55:47 UTC

Double free vulnerability in the _zip_dirent_read function in
zip_dirent.c in libzip allows attackers to have unspecified impact via
unknown vectors.

Upstream patch:

https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796

Comment 1 Pedro Sampaio 2017-08-23 18:56:36 UTC

Created libzip tracking bugs for this issue:

Affects: fedora-all [bug 1484515]


Created mingw-libzip tracking bugs for this issue:

Affects: fedora-all [bug 1484516]

Comment 2 Tomas Hoger 2020-02-28 20:43:20 UTC

The affected code was introduced via this commit in libzip version 1.2.0:

https://github.com/nih-at/libzip/commit/796c5968ad679220db3fb65ec6f48c66e554e5d5

The commit fixing the issue that is linked from comment 0 was applied in libzip version 1.3.0.