{"id":"CVE-2019-13453","aliases":["DEBIAN-CVE-2019-13453","DLA-3030-1","EUVD-2019-4926","GHSA-7vgw-qf5j-7533","MGASA-2019-0341","UBUNTU-CVE-2019-13453","USN-4055-1","USN-4057-1","openSUSE-SU-2024:13562-1"],"status":"published","title":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an...","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02026,"percentile":0.8127,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2019-07-15T00:00:00Z","modified":"2026-09-21T07:00:28Z","fixes":[{"ecosystem":"Debian:12","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-11"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-6+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"zipios++","fixed_in":["++-0.1.5.9-6.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-5.1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","fixed_in":["0.7.2+dfsg-6ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-5.2ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","fixed_in":["0.7.2+dfsg-10ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"zipios++","fixed_in":["0.1.5.9+cvs.2007.04.28-10ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-11"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-6+deb9u1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-6"]},{"source":"osv","ecosystem":"Mageia:7","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"++-0.1.5.9-6.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-5.1ubuntu0.14.04.1~esm1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-5.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-6ubuntu0.1"}]}],"versions":["0.7.2+dfsg-2","0.7.2+dfsg-3","0.7.2+dfsg-4","0.7.2+dfsg-5","0.7.2+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-5.2ubuntu0.16.04.1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-5.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-10ubuntu0.1"}]}],"versions":["0.7.2+dfsg-9","0.7.2+dfsg-9build1","0.7.2+dfsg-9build2","0.7.2+dfsg-10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.04.1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-6ubuntu0.1"}]}],"versions":["0.7.2+dfsg-2","0.7.2+dfsg-3","0.7.2+dfsg-4","0.7.2+dfsg-5","0.7.2+dfsg-6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flightcrew","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2+dfsg-10ubuntu0.1"}]}],"versions":["0.7.2+dfsg-9","0.7.2+dfsg-9build1","0.7.2+dfsg-9build2","0.7.2+dfsg-10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-5.2ubuntu0.16.04.1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-5.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zipios++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5.9+cvs.2007.04.28-10ubuntu0.18.04.1"}]}],"versions":["0.1.5.9+cvs.2007.04.28-10"]}],"products":[{"vendor":"zipios_project","product":"zipios"}],"references":[{"url":"https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/109282","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00041.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13453"},{"url":"https://github.com/advisories/GHSA-7vgw-qf5j-7533"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13453","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0341.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25282","tags":["report"]},{"url":"https://usn.ubuntu.com/4057-1/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-13453","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4055-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4057-1","tags":["advisory"]},{"url":"https://github.com/Sigil-Ebook/flightcrew/issues/54","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13241","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13453","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13453","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-17T14:17:56Z","modified":"2024-08-04T23:49:24.982Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4926","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-17T14:17:56Z","modified":"2024-08-04T23:49:24Z","updated_at":"2026-11-03T02:40:42.441902Z"}],"ghsa":[{"id":"GHSA-7vgw-qf5j-7533","title":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an...","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2022-05-24T16:50:31Z","modified":"2023-01-28T05:06:07Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:44:24.376453Z"}],"nvd":[{"id":"CVE-2019-13453","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-17T15:15:10.673Z","modified":"2026-06-17T02:16:46.733Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:05:20.616405Z"}],"osv":[{"id":"CVE-2019-13453","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-17T15:15:10.673Z","modified":"2026-04-16T04:33:08.160569159Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13453","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-17T15:15:10.673Z","modified":"2026-09-21T07:00:28.929376575Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13453","description":"Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().","status":"published","published":"2019-07-15T00:00:00Z","modified":"2026-04-22T12:10:26.736861Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-3030-1","title":"zipios++ - security update","status":"published","published":"2022-05-27T00:00:00Z","modified":"2026-03-09T01:18:09.810495Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2019-0341","title":"Updated zipios++ packages fix security vulnerability","description":"Updated zipios++ packages fix security vulnerability:\n\nMike Salvatore discovered that Zipios mishandled certain malformed ZIP\nfiles. An attacker could use this vulnerability to cause a denial of\nservice or consume system resources (CVE-2019-13453).\n","status":"published","published":"2019-11-30T13:06:06Z","modified":"2026-04-16T04:44:11.173414738Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:13562-1","title":"libzipios2-2.3.2-1.1 on GA media","description":"These are all security issues fixed in the libzipios2-2.3.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:30:35.723085Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-4055-1","title":"flightcrew vulnerabilities","description":"Mike Salvatore discovered that FlightCrew improperly handled certain\nmalformed EPUB files. An attacker could potentially use this vulnerability\nto cause a denial of service. (CVE-2019-13032)\n\nMike Salvatore discovered that FlightCrew mishandled certain malformed EPUB\nfiles. An attacker could use this vulnerability to write arbitrary files to\nthe filesystem. (CVE-2019-13241)\n\nMike Salvatore discovered that the version of Zipios included in FlightCrew\nmishandled certain malformed ZIP files. An attacker could use this vulnerability\nto cause a denial of service or consume system resources. (CVE-2019-13453)\n","status":"published","published":"2019-07-15T13:42:14Z","modified":"2026-04-22T09:59:44.778381Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4057-1","title":"Zipios vulnerability","description":"Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An\nattacker could use this vulnerability to cause a denial of service or consume\nsystem resources. (CVE-2019-13453)\n","status":"published","published":"2019-07-15T14:37:13Z","modified":"2026-04-22T09:58:57.612633Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}