Bug 1626200 – CVE-2018-16548 zziplib: Memory leak triggered in the function __zzip_parse_root_directory in zip.c

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1626200 - (CVE-2018-16548) CVE-2018-16548 zziplib: Memory leak triggered in the function __zzip_parse_root_directory in zip.c

Summary:	CVE-2018-16548 zziplib: Memory leak triggered in the function __zzip_parse_ro...

Status:	NEW

Aliases:	CVE-2018-16548

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180905,reported=2...
Keywords:	Security

Depends On:	1626201 1626202 1626635
Blocks:	1626203
	Show dependency tree / graph

Reported:	2018-09-06 13:45 EDT by Pedro Sampaio
Modified:	2018-09-07 14:38 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Pedro Sampaio 2018-09-06 13:45:54 EDT

An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which could lead to a denial of service attack.

Upstream issue:

https://github.com/gdraheim/zziplib/issues/58

Comment 1 Pedro Sampaio 2018-09-06 13:46:18 EDT

Created zziplib tracking bugs for this issue:

Affects: fedora-all [bug 1626201]

Comment 4 Scott Gayou 2018-09-07 14:35:16 EDT

Appears to have a very low impact. Easy to reproduce.

Comment 5 Scott Gayou 2018-09-07 14:37:17 EDT

Upstream Patches:
https://github.com/gdraheim/zziplib/commit/0e1dadb05c1473b9df2d7b8f298dab801778ef99
https://github.com/gdraheim/zziplib/commit/d2e5d5c53212e54a97ad64b793a4389193fec687
https://github.com/gdraheim/zziplib/commit/9411bde3e4a70a81ff3ffd256b71927b2d90dcbb

Untested, unclear if these completely fix the issue as the dev has not closed the upstream issue yet.

Note You need to log in before you can comment on or make changes to this bug.