Bug 1541256 (CVE-2018-6484)

Summary:	CVE-2018-6484 zziplib: Loading of misaligned memory address in zip.c:__zzip_fetch_disk_trailer can lead to a denial of service via crafted zip file
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abokovoy, jamartis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An unaligned memory access bug was found in the way ZZIPlib handled ZIP files. This flaw could potentially be used to crash the application using ZZIPlib by tricking the application into processing specially crafted ZIP files.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-21 03:49:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1541257, 1541260, 1545818
Bug Blocks:	1541259

Description Sam Fowler 2018-02-02 06:26:49 UTC

In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6484

Upstream Issue:
https://github.com/gdraheim/zziplib/issues/14

Comment 1 Sam Fowler 2018-02-02 06:27:11 UTC

Created zziplib tracking bugs for this issue:

Affects: fedora-all [bug 1541257]

Comment 7 Product Security DevOps Team 2020-02-21 03:49:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-6484