Zziplib
CVE-2017-5981
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Impact | CVSS score of 5.5 (MEDIUM). Attack characteristics: local attack vector, low complexity, no privileges required, user interaction required. Public proof-of-concept exploit code is available. EPSS exploitation probability: 0.43%. |
| Exploit ScenarioDerived | Successful exploitation could compromise the medium-severity affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified under CWE-617. seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. Affected products include: Gdraheim Zziplib.
Know when Zziplib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_f
An issue was discovered in ZZIPlib through 0.13.69. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
An issue was discovered in ZZIPlib 0.13.68. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable
An issue was discovered in ZZIPlib 0.13.68. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable
An issue was discovered in ZZIPlib 0.13.68. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable
In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function o
In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned a
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local e
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function o
In ZZIPlib 0.13.67, there is a memory alignment error and bus error in the __zzip_fetch_disk_trailer function of zzip/zi
In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56
Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. Rated medium
GitHub PoC
Exploit-DB