CVE-2019-17582: Use After Free
A use-after-free in the zipdirentread function of zipdirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17582?
CVE-2019-17582 is classified as a use-after-free vulnerability which could allow attackers to exploit it for an unspecified impact.
How do I fix CVE-2019-17582?
To mitigate CVE-2019-17582, update libzip to a version newer than 1.2.0 where the vulnerability is addressed.
What software is affected by CVE-2019-17582?
CVE-2019-17582 specifically affects libzip version 1.2.0.
What type of attack can CVE-2019-17582 facilitate?
CVE-2019-17582 can facilitate attacks involving the exploitation of malformed ZIP archives leading to potential application crashes or unintended behavior.
Is there a known exploit for CVE-2019-17582?
As of now, there is no public information indicating that a specific exploit has been actively used for CVE-2019-17582.