Bug 1545813

Summary:	zziplib: improper fix for CVE-2018-6869 and CVE-2018-6484
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abokovoy, jamartis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An improper input validation was found in function __zzip_fetch_disk_trailer of ZZIPlib 0.13.68 that could lead to a crash in __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-21 08:21:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1545818, 1545819
Bug Blocks:	1543953

Description Riccardo Schirone 2018-02-15 15:44:07 UTC

It was discovered that the original fix for CVE-2018-6869 did not fully correct
CVE-2018-6484 and CVE-2018-6869. Function __zzip_fetch_disk_trailer uses signed
comparisons to check untrusted values which, in some configurations, are later
used in __zzip_parse_root_directory as parameter to mmap. Remote attackers
could leverage this vulnerability to cause a Denial of Service via a crafted
zip file.

Upstream issue:
https://github.com/gdraheim/zziplib/issues/27

Upstream patch:
https://github.com/gdraheim/zziplib/commit/8f48323c181e20b7e527b8be7229d6eb1148ec5f

Comment 1 Riccardo Schirone 2018-02-15 15:44:09 UTC

Acknowledgments:

Name: Riccardo Schirone (Red Hat)

Comment 2 Riccardo Schirone 2018-02-15 15:48:54 UTC

Created zziplib tracking bugs for this issue:

Affects: fedora-all [bug 1545819]

Comment 4 Riccardo Schirone 2018-03-21 08:21:48 UTC

Closing this as it triggers the same vulnerability as CVE-2018-7726.

*** This bug has been marked as a duplicate of bug 1554672 ***