CVE-2012-1162 Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a...
HighCVSS 7.5
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libzip(Debian:12) | < 0.10.1-1 | 0.10.1-1 |
| debian/libzip(Debian:13) | < 0.10.1-1 | 0.10.1-1 |
| debian/libzip(Debian:14) | < 0.10.1-1 | 0.10.1-1 |
| nih libzip | = 0.10 | No fix listed |
References
- Debian Security Tracker CVE-2012-1162 vendor-advisory
- [libzip-discuss] 20120320 libzip-0.10.1 security fix release exploit mailing-list
- GLSA-201203-23 vendor-advisory
- MDVSA-2012:034 vendor-advisory
- www.nih.at
- [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip exploit mailing-list
- [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip mailing-list
- bugs.debian.org issue-tracking