CVE-2020-18770

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.

The zziplib is a lightweight library to easily extract data from zip files. Applications can bundle files into a single zip archive and access them. The implementation is based only on the (free) subset of compression with the zlib algorithm which is actually used by the zip/unzip tools.

Security Fix(es):

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.(CVE-2020-18770)

The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

• zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

• zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.

The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

• zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

• zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2020-18770: fix denial-of-service issue in zzip_disk_entry_to_file_header function in mmapped.c

An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service. (CVE-2020-18770)

These are all security issues fixed in the libzzip-0-13-0.13.72-3.1 package on the GA media of openSUSE Tumbleweed.

This update for zziplib fixes the following issues:

• CVE-2020-18770: Fixed denial-of-service in function zzip_disk_entry_to_file_header in mmapped.c (bsc#1214577).

This update for zziplib fixes the following issues:

Security issue fixed:

• CVE-2020-18442: Fixed infinite loop in zzip_file_read() as used in unzzip_cat_file() (bsc#1187526).
• CVE-2020-18770: Fixed denial-of-service in function zzip_disk_entry_to_file_header in mmapped.c (bsc#1214577).

Non-security issue fixed:

• Implement an error message with a condition by checking the return value of a function call. (bsc#1154002)