Bug 1541256 (CVE-2018-6484) - CVE-2018-6484 zziplib: Loading of misaligned memory address in zip.c:__zzip_fetch_disk_trailer can lead to a denial of service via crafted zip file
Summary: CVE-2018-6484 zziplib: Loading of misaligned memory address in zip.c:__zzip_f...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-6484
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1541257 1541260 1545818
Blocks: 1541259
TreeView+ depends on / blocked
 
Reported: 2018-02-02 06:26 UTC by Sam Fowler
Modified: 2020-02-21 03:49 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-02-21 03:49:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-02-02 06:26:49 UTC 
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6484

Upstream Issue:
https://github.com/gdraheim/zziplib/issues/14
Comment 1 Sam Fowler 2018-02-02 06:27:11 UTC 
Created zziplib tracking bugs for this issue:

Affects: fedora-all [bug 1541257]
Comment 7 Product Security DevOps Team 2020-02-21 03:49:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-6484
Note You need to log in before you can comment on or make changes to this bug.