CVE-2020-18442: Low severity zziplib vulnerability
Published Jun 18, 2021
·Updated
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzipfileread" in the function "unzzipcatfile".
Affected Software
10 affected componentsFixes available
debian/zziplib
0.13.62-3.2+deb10u10.13.62-3.3+deb11u10.13.72+dfsg.1-1.1
ubuntu/zziplib<0.13.72+dfsg.1-1
0.13.72+dfsg.1-1
ubuntu/zziplib<0.13.62-3.1ubuntu0.18.04.1+
0.13.62-3.1ubuntu0.18.04.1+
ubuntu/zziplib<0.13.62-3.2ubuntu1.1
0.13.62-3.2ubuntu1.1
ubuntu/zziplib<0.13.62-3ubuntu0.16.04.2+
0.13.62-3ubuntu0.16.04.2+
Zziplib Project Zziplib=0.13.69
Debian Debian Linux=9.0
Fedoraproject Fedora=34
Fedoraproject Fedora=35
gdraheim zziplib=0.13.69
Remediation
Patch Available
Event History
Jun 18, 2021
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
Description
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:44 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-18442?
CVE-2020-18442 is identified as a denial of service vulnerability due to an infinite loop in zziplib.
2
How do I fix CVE-2020-18442?
To resolve CVE-2020-18442, upgrade zziplib to versions 0.13.62-3.2+deb10u1, 0.13.62-3.3+deb11u1, or 0.13.72+dfsg.1-1.
3
What versions of zziplib are affected by CVE-2020-18442?
Affected versions of zziplib include 0.13.69; upgrading to a fixed version is necessary.
4
Can remote attackers exploit CVE-2020-18442?
Yes, remote attackers can exploit CVE-2020-18442 to create a denial of service condition.
5
What systems are impacted by CVE-2020-18442?
CVE-2020-18442 impacts systems running affected versions of zziplib, including Debian and Fedora.