{"id":"CVE-2018-7726","aliases":["DEBIAN-CVE-2018-7726","DLA-2258-1","EUVD-2018-19441","GHSA-ffcx-x762-rr86","MGASA-2019-0093","RHSA-2018:3229","SUSE-SU-2018:0919-1","UBUNTU-CVE-2018-7726","USN-3699-1","openSUSE-SU-2024:11546-1"],"status":"published","title":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the...","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0169,"percentile":0.77205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-03-06T00:00:00Z","modified":"2026-10-23T18:04:48Z","fixes":[{"ecosystem":"Debian:12","package":"zziplib","fixed_in":["0.13.62-3.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zziplib","fixed_in":["0.13.62-3.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zziplib","fixed_in":["0.13.62-3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"zziplib","fixed_in":["0.13.62-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"zziplib","fixed_in":["0.13.62-3ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"zziplib","fixed_in":["0.13.62-3.1ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3.2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3+deb8u2"}]}],"versions":["0.13.62-3","0.13.62-3+deb8u1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.69-1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"zziplib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.62-9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.67-10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-2ubuntu0.2"}]}],"versions":["0.13.56-1.1ubuntu1","0.13.56-1.1ubuntu2","0.13.56-2ubuntu1","0.13.62-2","0.13.62-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3ubuntu0.16.04.2"}]}],"versions":["0.13.62-3","0.13.62-3ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3.1ubuntu0.18.04.1"}]}],"versions":["0.13.62-3.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-2ubuntu0.2"}]}],"versions":["0.13.56-1.1ubuntu1","0.13.56-1.1ubuntu2","0.13.56-2ubuntu1","0.13.62-2","0.13.62-2ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3ubuntu0.16.04.2"}]}],"versions":["0.13.62-3","0.13.62-3ubuntu0.16.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.62-3.1ubuntu0.18.04.1"}]}],"versions":["0.13.62-3.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"zziplib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.72-1.4"}]}],"bundled":14}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gdraheim","product":"zziplib"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://usn.ubuntu.com/3699-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3229","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/gdraheim/zziplib/issues/41","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7726","tags":["advisory"]},{"url":"https://usn.ubuntu.com/3699-1"},{"url":"https://github.com/advisories/GHSA-ffcx-x762-rr86"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-7726","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0093.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22570","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/R5NI6QBHJA6ZI7AYP4BYGADTML3F2LNO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/T5F2Q7GQYRYWHMTEF2OKBIHBBFV6SZBY/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/I6J523IVLVVPUEHRDYT54A5QOKM5XVTO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MKVLTCQZTM4IO2OP63CRKPLX6NQKLQ2O/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16548","tags":["advisory"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-02/msg00110.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00017.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-10/msg00130.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3229.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7725","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7726","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7727","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180919-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084517","tags":["report"]},{"url":"https://bugzilla.suse.com/1084519","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7726","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-7726","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3699-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-6869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7725","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6542","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-7726","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T17:00:00Z","modified":"2024-08-05T06:31:05.122Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-19441","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T17:00:00Z","modified":"2024-08-05T06:31:05Z","updated_at":"2026-11-03T02:40:05.186892Z"}],"ghsa":[{"id":"GHSA-ffcx-x762-rr86","title":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the...","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2022-05-13T01:25:29Z","modified":"2025-07-10T18:32:12Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:02:58.788337Z"}],"nvd":[{"id":"CVE-2018-7726","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T17:29:00.543Z","modified":"2026-06-17T02:03:36.05Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:23.783914Z"}],"osv":[{"id":"CVE-2018-7726","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T17:29:00.543Z","modified":"2026-10-20T10:50:30.327695944Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-7726","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T17:29:00.543Z","modified":"2026-10-23T18:04:48.34961559Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2018:3229","title":"Red Hat Security Advisory: zziplib security update","status":"published","published":"2024-09-16T01:37:23Z","modified":"2026-06-26T10:39:34Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-7726","description":"An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.","status":"published","published":"2018-03-06T00:00:00Z","modified":"2026-04-22T12:03:33.880375Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-2258-1","title":"zziplib - security update","status":"published","published":"2020-06-28T00:00:00Z","modified":"2026-03-09T01:19:22.799772Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0093","title":"Updated zziplib packages fix security vulnerability","description":"In ZZIPlib 0.13.67, there is a segmentation fault caused by invalid memory\naccess in the zzip_disk_fread function (zzip/mmapped.c) because the size\nvariable is not validated against the amount of file-\u003estored data\n(CVE-2018-6381).\n\nAn unaligned memory access bug was found in the way ZZIPlib handled ZIP files.\nThis flaw could potentially be used to crash the application using ZZIPlib by\ntricking the application into processing specially crafted ZIP files\n(CVE-2018-6484).\n\nIn ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned\naddress in the zzip_disk_findfirst function of zzip/mmapped.c. Remote\nattackers could leverage this vulnerability to cause a denial of service via a\ncrafted zip file (CVE-2018-6540).\n\nA flaw was found in ZZIPlib 0.13.67, there is a bus error caused by loading of\na misaligned address (when handling disk64_trailer local entries) in\n__zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this\nvulnerability to cause a denial of service via a crafted zip file\n(CVE-2018-6541).\n\nIn ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek\nvalue) caused by loading of a misaligned address in the zzip_disk_findfirst\nfunction of zzip/mmapped.c (CVE-2018-6542).\n\nAn uncontrolled memory allocation was found in ZZIPlib that could lead to a\ncrash in the __zzip_parse_root_directory function of zzip/zip.c if the package\nis compiled with Address Sanitizer. Remote attackers could leverage this\nvulnerability to cause a denial of service via a crafted zip file\n(CVE-2018-6869).\n\nAn out of bounds read was found in function zzip_disk_fread of ZZIPlib, up to\n0.13.68, when ZZIPlib mem_disk functionality is used. Remote attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7725).\n\nAn improper input validation was found in function __zzip_fetch_disk_trailer\nof ZZIPlib, up to 0.13.68, that could lead to a crash in\n__zzip_parse_root_directory function of zzip/zip.c. Remote attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7726).\n\nA memory leak was found in unzip-mem.c and unzzip-mem.c of ZZIPlib, up to\nv0.13.68, that could lead to resource exhaustion. Local attackers could\nleverage this vulnerability to cause a denial of service via a crafted zip\nfile (CVE-2018-7727).\n\nAn issue was discovered in ZZIPlib through 0.13.69. There is a memory leak\ntriggered in the function __zzip_parse_root_directory in zip.c, which could\nlead to a denial of service attack (CVE-2018-16548).\n\nA flaw was found in ZZIPlib 0.13.69. A directory traversal vulnerability\nallows attackers to overwrite arbitrary files via a .. (dot dot) in a zip\nfile, because of the function unzzip_cat in the bins/unzzipcat-mem.c file\n(CVE-2018-17828).\n","status":"published","published":"2019-02-20T22:18:01Z","modified":"2026-04-16T04:41:25.353199312Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11546-1","title":"libzzip-0-13-0.13.72-1.4 on GA media","description":"These are all security issues fixed in the libzzip-0-13-0.13.72-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:15.758144Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0919-1","title":"Security update for zziplib","description":"This update for zziplib fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7726: There is a bus error caused by the__zzip_parse_root_directory function of zip.c. Attackers could leverage thisvulnerability to cause a denial of service (bsc#1084517).\n- CVE-2018-7725: An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an application crash, which leads to denial of service (bsc#1084519).\n","status":"published","published":"2018-04-11T06:43:27Z","modified":"2025-05-02T04:08:25.065422Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3699-1","title":"zziplib vulnerabilities","description":"It was discovered that zziplib incorrectly handled certain malformed ZIP\nfiles. If a user or automated system were tricked into opening a specially\ncrafted ZIP file, a remote attacker could cause zziplib to crash, resulting\nin a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2018-07-03T12:47:12Z","modified":"2026-04-22T09:47:15.848308Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}