CVE-2024-39133 — Heap-based Buffer Overflow in Zziplib

CWE-122 — Heap-based Buffer OverflowCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 46.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Gdraheim ZziplibDebian ZziplibZziplib Project Zziplib+1 more
Timeline
PublishedJun 27

Description

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/zziplib< zziplib 0.13.78+dfsg.1-0.1 (forky)
▶Debiangdraheim/zziplib< 0.13.78+dfsg.1-0.1+1

🔴Vulnerability Details

2
OSV
CVE-2024-39133: Heap Buffer Overflow vulnerability in zziplib v0↗2024-06-27
▶
GHSA
GHSA-pmxx-f7h9-2q7w: Heap Buffer Overflow vulnerability in zziplib v0↗2024-06-27
▶

📋Vendor Advisories

3
Red Hat
zziplib: Heap buffer overflow in the __zzip_parse_root_directory() function at /zzip/zip.c↗2024-06-27
▶
Microsoft
Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.↗2024-06-11
▶
Debian
CVE-2024-39133: zziplib - Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause...↗2024
▶