CVE-2012-1163 Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive,...
MediumCVSS 6.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libzip(Debian:12) | < 0.10.1-1 | 0.10.1-1 |
| debian/libzip(Debian:13) | < 0.10.1-1 | 0.10.1-1 |
| debian/libzip(Debian:14) | < 0.10.1-1 | 0.10.1-1 |
| nih libzip | = 0.10 | No fix listed |
References
- Debian Security Tracker CVE-2012-1163 vendor-advisory
- [libzip-discuss] 20120320 libzip-0.10.1 security fix release mailing-list
- GLSA-201203-23 vendor-advisory
- MDVSA-2012:034 vendor-advisory
- www.nih.at
- [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip mailing-list
- [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip mailing-list
- bugs.debian.org issue-tracking