CVE-2018-7727: Medium severity Zziplib Project Zziplib vulnerability
An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzipmemdisknew in memdisk.c, which will lead to a denial of service attack.
Other sources
ZZIPlib through version 0.13.68 is vulnerable to a memory leak in unzzipcat-mem.c:unzzipcat() and unzip-mem.c:main(), where a ZZIPMEMDISK is allocated but not released. An attacker could exploit this to cause a denial of service via a crafted zip file.
Upstream Issue: https://github.com/gdraheim/zziplib/issues/40
Upstream Patches: https://github.com/gdraheim/zziplib/commit/83a2da55922f67e07f22048ac9671a44cc0d35c4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/zziplibto a version that resolves this vulnerability.Fixed in 0.13.62-3ubuntu0.16.04.2+ - Upgrade
Upgrade
ubuntu/zziplibto a version that resolves this vulnerability.Fixed in 0.13.62-3.1ubuntu0.18.04.1+ - Upgrade
Upgrade
ubuntu/zziplibto a version that resolves this vulnerability.Fixed in 0.13.62-3.2ubuntu1.1 - Upgrade
Upgrade
redhat/zziplibto a version that resolves this vulnerability.Fixed in 0.13.69 - Upgrade
Upgrade
zziplib/ZZIPlibto a version that resolves this vulnerability.Fixed in 0.13.68Patch 83a2da55922f67e07f22048ac9671a44cc0d35c4 - Operational
Confirm and redeploy ZZIPlib so the memory-leak condition in zzip_mem_disk_new (memdisk.c) triggered via unzzipcat-mem.c:unzzip_cat() and unzip-mem.c:main() is eliminated, to prevent denial of service via crafted zip files.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7727?
CVE-2018-7727 has a severity rating that indicates it may lead to denial of service due to a memory leak.
How do I fix CVE-2018-7727?
To fix CVE-2018-7727, upgrade to versions of zziplib below 0.13.68, specifically 0.13.62-3.2ubuntu1.1 or later.
Which zziplib versions are affected by CVE-2018-7727?
CVE-2018-7727 specifically affects zziplib version 0.13.68.
What systems are vulnerable to CVE-2018-7727?
CVE-2018-7727 affects systems running zziplib version 0.13.68, particularly those on Ubuntu and Red Hat platforms.
What is the exploit type for CVE-2018-7727?
CVE-2018-7727 is classified as a denial of service exploit due to a memory leak.