CVE-2024-39134 — Classic Buffer Overflow in Zziplib

CWE-120 — Classic Buffer OverflowCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 36.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gdraheim ZziplibDebian ZziplibMsrc Azl3 Zziplib 0.13.74-1 ON Azure Linux 3.0
Timeline
PublishedJun 27

Description

A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/zziplib< zziplib 0.13.78+dfsg.1-0.1 (forky)
▶Debiangdraheim/zziplib< 0.13.78+dfsg.1-0.1+1
▶NVDgdraheim/zziplib0.13.77

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2024-39134: A Stack Buffer Overflow vulnerability in zziplibv 0↗2024-06-27
▶
GHSA
GHSA-g9gg-xprq-97gc: A Stack Buffer Overflow vulnerability in zziplibv 0↗2024-06-27
▶

📋Vendor Advisories

3
Red Hat
zziplib: Stack buffer overflow via __zzip_fetch_disk_trailer() function at zzip/zip.c↗2024-06-27
▶
Microsoft
A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.↗2024-06-11
▶
Debian
CVE-2024-39134: zziplib - A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to ca...↗2024
▶