{"id":"CVE-2018-17828","aliases":["ALSA-2020:1653","ALSA-2025:20478","ALSA-2025:20838","AZL-7014","AZL-7458","DEBIAN-CVE-2018-17828","EUVD-2018-9574","GHSA-g8rp-fvg9-52vv","MGASA-2019-0093","RHSA-2020:1178","RHSA-2020:1653","RHSA-2025:20478","RHSA-2025:20838","RLSA-2020:1653","RLSA-2025:20478","RLSA-2025:20838","SUSE-SU-2018:3220-1","SUSE-SU-2018:3379-1","UBUNTU-CVE-2018-17828","openSUSE-SU-2024:11546-1"],"status":"published","title":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary...","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01538,"percentile":0.75027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-10-01T08:00:00Z","modified":"2026-10-29T11:58:16Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"zziplib-devel","fixed_in":["0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"zziplib","fixed_in":["0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"zziplib-devel","fixed_in":["0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"zziplib-utils","fixed_in":["0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"zziplib","fixed_in":["0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"zziplib-devel","fixed_in":["0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"zziplib-utils","fixed_in":["0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"zziplib","fixed_in":["0.13.69-8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-debuginfo","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-devel","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-utils","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-debuginfo","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-devel","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-utils","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-debuginfo","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-devel","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-utils","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-debuginfo","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-devel","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-utils","fixed_in":["0:0.13.62-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-debuginfo","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-debugsource","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-utils","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-utils-debuginfo","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-debuginfo","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-debugsource","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-devel","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-utils-debuginfo","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-debuginfo","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-debugsource","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-utils","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-utils-debuginfo","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-devel","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-debuginfo","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-debugsource","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-utils","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-utils-debuginfo","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-debuginfo","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-debugsource","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-devel","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-utils-debuginfo","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"zziplib","fixed_in":["0:0.13.68-8.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"zziplib","fixed_in":["0:0.13.78-2.el10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"zziplib","fixed_in":["0:0.13.71-12.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"zziplib","fixed_in":["0.13.69-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zziplib","fixed_in":["0.13.67-10.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"zziplib","fixed_in":["0.13.67-10.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"zziplib","fixed_in":["0.13.67-10.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.69-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.69-8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.72+dfsg.1-1.1","0.13.72+dfsg.1-1.2","0.13.72+dfsg.1-1.2~exp1","0.13.72+dfsg.1-1.3","0.13.78+dfsg.1-0.1","0.13.78+dfsg.1-0.2"]},{"source":"osv","ecosystem":"Debian:13","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.78+dfsg.1-0.1","0.13.78+dfsg.1-0.2"]},{"source":"osv","ecosystem":"Debian:14","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.78+dfsg.1-0.1","0.13.78+dfsg.1-0.2"]},{"source":"osv","ecosystem":"Mageia:6","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.69-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"zziplib-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"zziplib-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"zziplib-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"zziplib-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.68-8.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.78-2.el10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.71-12.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.69-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.62-3","0.13.62-3ubuntu0.16.04.1","0.13.62-3ubuntu0.16.04.2","0.13.62-3ubuntu0.16.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.62-3.1","0.13.62-3.1ubuntu0.18.04.1","0.13.62-3.1ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.62-3.2","0.13.62-3.2ubuntu1","0.13.62-3.2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.72+dfsg.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.72+dfsg.1-1.1","0.13.72+dfsg.1-1.2","0.13.72+dfsg.1-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.78+dfsg.1-0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.78+dfsg.1-0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.78+dfsg.1-0.1","0.13.78+dfsg.1-0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.72-1.4"}]}],"bundled":14}],"products":[{"vendor":"gdraheim","product":"zziplib"}],"references":[{"url":"https://github.com/gdraheim/zziplib/issues/62","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17828","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g8rp-fvg9-52vv"},{"url":"https://vulners.com/cve/CVE-2018-17828","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:20478","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-17828","tags":["report"]},{"url":"https://bugzilla.redhat.com/1635888","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-20478.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:20838","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-20838.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-17828","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0093.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22570","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/R5NI6QBHJA6ZI7AYP4BYGADTML3F2LNO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/T5F2Q7GQYRYWHMTEF2OKBIHBBFV6SZBY/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/I6J523IVLVVPUEHRDYT54A5QOKM5XVTO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MKVLTCQZTM4IO2OP63CRKPLX6NQKLQ2O/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16548","tags":["advisory"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-02/msg00110.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00017.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-10/msg00130.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1178","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635888","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1178.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17828","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1653","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1653.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.1_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20478.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_20838.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:1653","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:20478","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:20838","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183220-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1110687","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17828","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183379-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-17828","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7726","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-17828","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:00:00Z","modified":"2026-10-15T17:34:48.331Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-9574","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:00:00Z","modified":"2026-10-15T17:34:48Z","updated_at":"2026-11-02T17:00:11.403253Z"}],"ghsa":[{"id":"GHSA-g8rp-fvg9-52vv","title":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary...","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2022-05-14T01:55:59Z","modified":"2023-02-02T05:04:47Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:51:57.541Z"}],"nvd":[{"id":"CVE-2018-17828","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:01.007Z","modified":"2026-10-15T18:17:14.51Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:42.52179Z"}],"osv":[{"id":"AZL-7014","title":"CVE-2018-17828 affecting package zziplib for versions less than 0.13.69-8","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:01Z","modified":"2026-04-21T04:36:20.097525Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-7458","title":"CVE-2018-17828 affecting package zziplib for versions less than 0.13.69-8","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:01Z","modified":"2026-04-21T04:38:45.388539Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"CVE-2018-17828","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:01.007Z","modified":"2026-10-20T10:50:22.551698783Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-17828","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:01.007Z","modified":"2026-10-15T21:47:33.879805876Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"RHSA-2020:1178","title":"Red Hat Security Advisory: zziplib security update","status":"published","published":"2024-09-16T03:04:04Z","modified":"2026-09-22T10:01:12Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1653","title":"Red Hat Security Advisory: zziplib security update","status":"published","published":"2024-09-16T03:04:11Z","modified":"2026-09-22T10:01:13Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2025:20478","title":"Red Hat Security Advisory: zziplib security update","status":"published","published":"2025-11-12T10:27:45Z","modified":"2026-09-22T10:05:00Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:20838","title":"Red Hat Security Advisory: zziplib security update","status":"published","published":"2025-11-12T10:28:03Z","modified":"2026-09-22T10:05:02Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2020:1653","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.\n\nSecurity Fix(es):\n\n* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.","status":"published","published":"2020-04-28T09:01:25Z","modified":"2026-02-04T14:00:10.26674Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2025:20478","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.\n\nSecurity Fix(es):\n\n* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.","status":"published","published":"2025-11-21T18:19:15.687303Z","modified":"2025-11-21T18:48:53.126285Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:20838","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.\n\nSecurity Fix(es):\n\n* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2025-11-21T18:13:51.682496Z","modified":"2025-11-21T18:48:53.711351Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2018-17828","description":"Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.","status":"published","published":"2018-10-01T08:29:00Z","modified":"2026-10-17T12:55:11.150424898Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"ALSA-2020:1653","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.\n\nSecurity Fix(es):\n\n* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-04-28T09:01:25Z","modified":"2026-10-29T11:00:10.106603443Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2025:20478","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.  \n\nSecurity Fix(es):  \n\n  * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2025-11-11T00:00:00Z","modified":"2026-10-29T11:58:16.901107Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:20838","title":"Moderate: zziplib security update","description":"The zziplib is a lightweight library to easily extract data from zip files.  \n\nSecurity Fix(es):  \n\n  * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2025-11-11T00:00:00Z","modified":"2026-10-29T11:32:28.682600726Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"MGASA-2019-0093","title":"Updated zziplib packages fix security vulnerability","description":"In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory\naccess in the zzip_disk_fread function (zzip/mmapped.c) because the size\nvariable is not validated against the amount of file-\u003estored data\n(CVE-2018-6381).\n\nAn unaligned memory access bug was found in the way ZZIPlib handled ZIP files.\nThis flaw could potentially be used to crash the application using ZZIPlib by\ntricking the application into processing specially crafted ZIP files\n(CVE-2018-6484).\n\nIn ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned\naddress in the zzip_disk_findfirst function of zzip/mmapped.c. Remote\nattackers could leverage this vulnerability to cause a denial of service via a\ncrafted zip file (CVE-2018-6540).\n\nA flaw was found in ZZIPlib 0.13.67, there is a bus error caused by loading of\na misaligned address (when handling disk64_trailer local entries) in\n__zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this\nvulnerability to cause a denial of service via a crafted zip file\n(CVE-2018-6541).\n\nIn ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek\nvalue) caused by loading of a misaligned address in the zzip_disk_findfirst\nfunction of zzip/mmapped.c (CVE-2018-6542).\n\nAn uncontrolled memory allocation was found in ZZIPlib that could lead to a\ncrash in the __zzip_parse_root_directory function of zzip/zip.c if the package\nis compiled with Address Sanitizer. Remote attackers could leverage this\nvulnerability to cause a denial of service via a crafted zip file\n(CVE-2018-6869).\n\nAn out of bounds read was found in function zzip_disk_fread of ZZIPlib, up to\n0.13.68, when ZZIPlib mem_disk functionality is used. Remote attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7725).\n\nAn improper input validation was found in function __zzip_fetch_disk_trailer\nof ZZIPlib, up to 0.13.68, that could lead to a crash in\n__zzip_parse_root_directory function of zzip/zip.c. Remote attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7726).\n\nA memory leak was found in unzip-mem.c and unzzip-mem.c of ZZIPlib, up to\nv0.13.68, that could lead to resource exhaustion. Local attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7727).\n\nAn issue was discovered in ZZIPlib through 0.13.69. There is a memory leak\ntriggered in the function __zzip_parse_root_directory in zip.c, which could\nlead to a denial of service attack (CVE-2018-16548).\n\nA flaw was found in ZZIPlib 0.13.69. A directory traversal vulnerability\nallows attackers to overwrite arbitrary files via a .. (dot dot) in a zip\nfile, because of the function unzzip_cat in the bins/unzzipcat-mem.c file\n(CVE-2018-17828).\n","status":"published","published":"2019-02-20T22:18:01Z","modified":"2026-04-16T04:41:25.353199312Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11546-1","title":"libzzip-0-13-0.13.72-1.4 on GA media","description":"These are all security issues fixed in the libzzip-0-13-0.13.72-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:15.758144Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:3220-1","title":"Security update for zziplib","description":"This update for zziplib fixes the following issues:\n\n- CVE-2018-17828: Remove any '../' components from pathnames of extracted files to avoid path traversal during unpacking. (bsc#1110687)\n","status":"published","published":"2018-10-18T12:29:33Z","modified":"2026-02-04T02:54:19.138207Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3379-1","title":"Security update for zziplib","description":"This update for zziplib fixes the following issues:\n\n- CVE-2018-17828: Remove any '../' components from pathnames of extracted files to avoid path traversal during unpacking. (bsc#1110687)\n","status":"published","published":"2018-10-24T09:00:31Z","modified":"2026-02-04T03:17:44.674398Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}