Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-39133: zziplib Denial of Service via Malicious Zip File

CVE-2024-39133 · published 2 years ago

Summary

A bug in the zziplib library allows an attacker to create a malicious zip file that can crash a program using this library. This could potentially disrupt business operations if not addressed. To fix this, update to the latest version of zziplib.

What to do

Update debian zziplib to version 0.13.78+dfsg.1-0.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	zziplib	All versions
Debian:13	debian	zziplib	< 0.13.78+dfsg.1-0.1 Fix: upgrade to 0.13.78+dfsg.1-0.1
–	zziplib_project	zziplib	0.13.77 `cpe:2.3:a:zziplib_project:zziplib:0.13.77:::::::*`
Ubuntu:Pro:16.04:LTS	canonical	zziplib	All versions

Original advisory text

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39133... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-39133 Vendor Advisory
https://github.com/gdraheim/zziplib/issues/164 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2024-39133 Vendor Advisory
https://ubuntu.com/security/CVE-2024-39133 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-39133 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published27 Jun 2024

Updated4 Nov 2026

First seen9 Jul 2026

Sources

CVE-2024-39133 · OSV

CVE-2024-39133 · NVD

DEBIAN-CVE-2024-39133 · OSV

UBUNTU-CVE-2024-39133 · OSV

Track software like this

Free during beta