Bug 1541256 (CVE-2018-6484) - CVE-2018-6484 zziplib: Loading of misaligned memory address in zip.c:__zzip_fetch_disk_trailer can lead to a denial of service via crafted zip file
Summary: CVE-2018-6484 zziplib: Loading of misaligned memory address in zip.c:__zzip_f...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-6484
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1541257 1541260 1545818
Blocks: 1541259
TreeView+ depends on / blocked
 
Reported: 2018-02-02 06:26 UTC by Sam Fowler
Modified: 2020-02-21 03:49 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An unaligned memory access bug was found in the way ZZIPlib handled ZIP files. This flaw could potentially be used to crash the application using ZZIPlib by tricking the application into processing specially crafted ZIP files.
Clone Of:
Environment:
Last Closed: 2020-02-21 03:49:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-02-02 06:26:49 UTC 
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6484

Upstream Issue:
https://github.com/gdraheim/zziplib/issues/14
Comment 1 Sam Fowler 2018-02-02 06:27:11 UTC 
Created zziplib tracking bugs for this issue:

Affects: fedora-all [bug 1541257]
Comment 7 Product Security DevOps Team 2020-02-21 03:49:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-6484
Note You need to log in before you can comment on or make changes to this bug.