Bug 233700 (CVE-2007-1614)

Summary:	CVE-2007-1614: zzliplib stack-based buffer overflow
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	zziplib	Assignee:	Matthias Saou <matthias>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6	CC:	fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-04-11 21:26:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-03-23 20:58:57 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1614

"Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c
in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause
a denial of service (application crash) or execute arbitrary code via a long
filename."

Comment 1 Matthias Saou 2007-04-11 21:26:50 UTC

Packages of 0.13.49 have been pushed to all current branches on March 26. Sorry
for forgetting to update and close this bug report.