CVE-2024-39133

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of...

4.3 MediumFix available

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.50%Up 0.5 points since Jun 28, 2024

What each source reports

CVE List Score used 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: CVE-2024-39133
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2024-37846 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: EUVD-2024-37846
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pmxx-f7h9-2q7w 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of...

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: GHSA-pmxx-f7h9-2q7w
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-122
Updated: 2026-11-02

NVD 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: CVE-2024-39133
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-122
Updated: 2026-11-02

OSV 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: CVE-2024-39133
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-39133 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: DEBIAN-CVE-2024-39133
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2024-39133 4.3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: UBUNTU-CVE-2024-39133
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVAZL-43591 No score

CVE-2024-39133 affecting package zziplib 0.13.72-3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: AZL-43591
Updated: 2026-11-02

OSVAZL-44520 No score

CVE-2024-39133 affecting package zziplib for versions less than 0.13.74-1

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

Record: AZL-44520
Updated: 2026-11-05

OSVopenSUSE-SU-2024:14259-1 No score

libzzip-0-13-0.13.78-1.1 on GA media

These are all security issues fixed in the libzzip-0-13-0.13.78-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14259-1
Updated: 2026-11-02

Affected products

zziplib project zziplib

Affected packages

Affected packages
Package	Affected	Fixed
`zziplib` Azure Linux:2	through 0.13.72-3	None known
`zziplib` Azure Linux:3	before 0.13.74-1	0.13.74-1
`zziplib` Debian:12	All versions, plus listed versions 0.13.72+dfsg.1-1.10.13.72+dfsg.1-1.20.13.72+dfsg.1-1.2~exp10.13.72+dfsg.1-1.30.13.78+dfsg.1-0.10.13.78+dfsg.1-0.2	None known
`zziplib` Debian:13	before 0.13.78+dfsg.1-0.1	0.13.78+dfsg.1-0.1
`zziplib` Debian:14	before 0.13.78+dfsg.1-0.1	0.13.78+dfsg.1-0.1
`zziplib` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.13.62-30.13.62-3ubuntu0.16.04.10.13.62-3ubuntu0.16.04.20.13.62-3ubuntu0.16.04.2+esm1	None known
`zziplib` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.13.62-3.10.13.62-3.1ubuntu0.18.04.10.13.62-3.1ubuntu0.18.04.1+esm1	None known
`zziplib` Ubuntu:20.04:LTS	All versions, plus listed versions 0.13.62-3.20.13.62-3.2ubuntu10.13.62-3.2ubuntu1.1	None known
`zziplib` Ubuntu:22.04:LTS	All versions, plus listed versions 0.13.72+dfsg.1-1.1	None known
`zziplib` Ubuntu:24.04:LTS	All versions, plus listed versions 0.13.72+dfsg.1-1.10.13.72+dfsg.1-1.20.13.72+dfsg.1-1.2build1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`zziplib` Ubuntu:25.10	All versions, plus listed versions 0.13.78+dfsg.1-0.1	None known
`zziplib` Ubuntu:26.10	All versions, plus listed versions 0.13.78+dfsg.1-0.2	None known
`zziplib` Ubuntu:26.04:LTS	All versions, plus listed versions 0.13.78+dfsg.1-0.10.13.78+dfsg.1-0.2	None known
`zziplib` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 0.13.78-1.1	0.13.78-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-39133 is a medium vulnerability (CVSS 4.3) in Zziplib Project Zziplib, published June 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in zziplib 0.13.74-1.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References