CVE catalog

CVE-2017-5976

zziplib: CVE-2017-5976

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.03% · Oct 25, 2026

Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzziplibsid0.13.78+dfsg.1-0.2fixed
Debianzziplibforky0.13.78+dfsg.1-0.2fixed
Debianzziplibtrixie0.13.78+dfsg.1-0.1fixed
Debianzziplibbookworm0.13.72+dfsg.1-1.1fixed
Ubuntuzziplib14.040.13.56-1.1ubuntu1vulnerable
Ubuntuzziplib14.040.13.56-1.1ubuntu2vulnerable
Ubuntuzziplib14.040.13.56-2ubuntu1vulnerable
Ubuntuzziplib14.040.13.62-2vulnerable
Ubuntuzziplib14.040.13.62-2ubuntu0.1fixed
Ubuntuzziplib16.040.13.62-3vulnerable
Ubuntuzziplib16.040.13.62-3ubuntu0.16.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzziplibsourcesid0.13.62-3.1not yet assignedNot reported[854727]
Debianzziplibsourceforky0.13.62-3.1not yet assignedNot reported[854727]
Debianzziplibsourcetrixie0.13.62-3.1not yet assignedNot reported[854727]
Debianzziplibsourcebookworm0.13.62-3.1not yet assignedNot reported[854727]
Ubuntuzziplibdeb14.040.13.62-2ubuntu0.1Not reportedUBUNTU-CVE-2017-5976Not reported
Ubuntuzziplibdeb16.040.13.62-3ubuntu0.16.04.1Not reportedUBUNTU-CVE-2017-5976Not reported

[Debian bug #854727]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzzip-0-13]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.72+dfsg.1-1.1 · amd64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

    • 0.13.72+dfsg.1-1.1 · arm64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

  • [libzzip-dev]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.72+dfsg.1-1.1 · amd64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

    • 0.13.72+dfsg.1-1.1 · arm64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

  • [zziplib-bin]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.72+dfsg.1-1.1 · amd64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

    • 0.13.72+dfsg.1-1.1 · arm64 · bookworm

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

[Debian 13 (Trixie)]

  • [libzzip-0-13t64]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.78+dfsg.1-0.1 · amd64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

    • 0.13.78+dfsg.1-0.1 · arm64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

  • [libzzip-dev]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.78+dfsg.1-0.1 · amd64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

    • 0.13.78+dfsg.1-0.1 · arm64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

  • [zziplib-bin]Fixed

    Source package: [zziplib]

    Details (2)

    • 0.13.78+dfsg.1-0.1 · amd64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

    • 0.13.78+dfsg.1-0.1 · arm64 · trixie

      Fixed · Fixed: 0.13.62-3.1

      dsa · zziplib · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]