CVE-2018-6540: Medium severity Zziplib Project Zziplib vulnerability
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzipdiskfindfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zziplibto a version that resolves this vulnerability.Fixed in 0.13.62-3.3+deb11u1Fixed in 0.13.72+dfsg.1-1.1Fixed in 0.13.72+dfsg.1-1.2Fixed in 0.13.72+dfsg.1-1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6540?
CVE-2018-6540 has a medium severity level due to the potential for denial of service attacks.
How do I fix CVE-2018-6540?
To resolve CVE-2018-6540, upgrade to a version of zziplib that is higher than 0.13.67.
What could happen if CVE-2018-6540 is exploited?
Exploitation of CVE-2018-6540 can lead to a crash of the application, resulting in denial of service.
Which versions of zziplib are affected by CVE-2018-6540?
ZZIPlib versions up to and including 0.13.67 are affected by CVE-2018-6540.
Are there any known workarounds for CVE-2018-6540?
There are no known workarounds for CVE-2018-6540 other than upgrading the affected package.