CVE-2017-5980: Null Pointer Dereference
Published Mar 1, 2017
·Updated
The zzipmementrynew function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
Affected Software
2 affected components
Zziplib Project Zziplib=0.13.62
gdraheim zziplib=0.13.62
Event History
Mar 1, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-5980?
CVE-2017-5980 has been classified as a medium-severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2017-5980?
To fix CVE-2017-5980, upgrade zziplib to version 0.13.63 or later, where the vulnerability has been addressed.
3
What type of attack does CVE-2017-5980 enable?
CVE-2017-5980 allows remote attackers to perform a denial of service attack through a crafted ZIP file.
4
Which versions of zziplib are affected by CVE-2017-5980?
CVE-2017-5980 affects zziplib version 0.13.62 specifically.
5
What function is responsible for the vulnerability in CVE-2017-5980?
The vulnerability in CVE-2017-5980 is caused by the zzip_mem_entry_new function in memdisk.c.