CVE-2015-2331

published 2015-03-30

CVE-2015-2331: Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before…

Priority P2 70 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

ITW VulnCheck KEV

Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

Affected

42 ranges · showing 25

Vendor	Product	Version range	Fixed in
apple	os_x_el_capitan_v10.11	—	—
debian	debian_linux	—	—
debian	libzip	< libzip 0.11.2-1.2 (bookworm)	libzip 0.11.2-1.2 (bookworm)
fedoraproject	fedora	—	—
libzip	libzip	>= 0 < 0.11.2-1.2	0.11.2-1.2
libzip	libzip	>= 0 < 0.11.2-1.2	0.11.2-1.2
libzip	libzip	>= 0 < 0.11.2-1.2	0.11.2-1.2
libzip	libzip	>= 0 < 0.11.2-1.2	0.11.2-1.2
nih	libzip	<= 0.11.2	—
opensuse	opensuse	—	—
opensuse	opensuse	—	—
php	php	<= 5.4.38	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability is triggered by a ZIP archive containing many entries (Zip64 format), causing an integer overflow in _zip_cdir_new() in zip_dirent.c, leading to a heap-based buffer overflow. Detect suspicious ZIP files with an abnormally large number of central directory entries, especially those using Zip64 extensions. ↗
• → The overflow is only triggerable via the Zip64 central directory code path (_zip_read_eocd64), where the number of entries is stored as a 64-bit value. Inspect ZIP files for Zip64 end-of-central-directory records with extremely large entry counts as a detection signal. ↗
• → Affected function is _zip_cdir_new() in zip_dirent.c in libzip 0.11.2 and earlier (specifically versions 0.11+). Monitor for crashes or anomalous memory allocation failures in processes parsing ZIP files using libzip 0.11.x. ↗
• → PHP versions before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 embed vulnerable libzip. Monitor PHP processes handling ZIP file uploads for crashes or unexpected code execution. ↗

• · The integer overflow is only exploitable on 32-bit systems for libzip versions between the Zip64 nentry-type change commit and the fix, because on 64-bit systems the nentry type is zip_uint64_t and overflow arithmetic differs. ↗
• · libzip versions prior to 0.11 are not affected because the entry count is read as a 16-bit value (max 65535), which is insufficient to trigger the overflow when multiplied by sizeof(struct zip_dirent). ↗
• · Red Hat Enterprise Linux 5, 6, and 7 PHP and libzip packages are NOT affected, as they ship libzip versions 0.9.x and 0.10.1 which predate the vulnerable Zip64 code path. ↗

CVSS provenance

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 7.5 HIGH

vulncheck 7.5 HIGH

vendor_debian 7.5 HIGH

vendor_redhat 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-189 CWE-190