CVE catalog

CVE-2020-18770

zziplib: CVE-2020-18770

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Aug 22, 2023, 7:15:55 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

An invalid memory access flaw was found in the mmapped.c file's zzip_disk_entry_to_file_header function in Zziplib. This issue could allow an attacker to entice a victim into opening a specially crafted file, leading to a denial of service. zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	zziplib	sid	`0.13.78+dfsg.1-0.2`	fixed
Debian	zziplib	forky	`0.13.78+dfsg.1-0.2`	fixed
Debian	zziplib	trixie	`0.13.78+dfsg.1-0.1`	fixed
Debian	zziplib	bookworm	`0.13.72+dfsg.1-1.1`	vulnerable
Suse	zziplib	linux enterprise software development kit 12 sp5	`0.13.67-10.36.1`	fixed
Suse	zziplib	linux enterprise workstation extension 12 sp5	`0.13.67-10.36.1`	fixed
Opensuse	zziplib	tumbleweed	`0.13.72-3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	zziplib	source	sid	`0.13.78+dfsg.1-0.1`	not yet assigned	Not reported	[1054910]
Debian	zziplib	source	forky	`0.13.78+dfsg.1-0.1`	not yet assigned	Not reported	[1054910]
Debian	zziplib	source	trixie	`0.13.78+dfsg.1-0.1`	not yet assigned	Not reported	[1054910]
Debian	zziplib	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1054910]
Suse	zziplib	rpm	linux enterprise software development kit 12 sp5	`0.13.67-10.36.1`	Not reported	SUSE-SU-2024:0961-1	Not reported
Suse	zziplib	rpm	linux enterprise workstation extension 12 sp5	`0.13.67-10.36.1`	Not reported	SUSE-SU-2024:0961-1	Not reported
Opensuse	zziplib	rpm	tumbleweed	`0.13.72-3.1`	Not reported	OPENSUSE-SU-2024:13746-1	Not reported

[Debian bug #1054910]

Notes

[bookworm] zziplib: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libzzip-0-13]Affected
Source package: [zziplib]
Details (2)
- 0.13.72+dfsg.1-1.1 · amd64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12
- 0.13.72+dfsg.1-1.1 · arm64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12
[libzzip-dev]Affected
Source package: [zziplib]
Details (2)
- 0.13.72+dfsg.1-1.1 · amd64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12
- 0.13.72+dfsg.1-1.1 · arm64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12
[zziplib-bin]Affected
Source package: [zziplib]
Details (2)
- 0.13.72+dfsg.1-1.1 · amd64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12
- 0.13.72+dfsg.1-1.1 · arm64 · bookworm
  Affected
  dsa · zziplib · debian · bookworm; dsa · zziplib · debian · 12

[openSUSE Tumbleweed]

[libzzip-0-13]Unknown
Source package: [zziplib]
Details (1)
- 0.13.80-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 0.13.72-3.1
  Version impact unknown
  dsa · zziplib · opensuse · tumbleweed
[libzzip-0-13-32bit]Unknown
Source package: [zziplib]
Details (1)
- 0.13.80-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 0.13.72-3.1
  Version impact unknown
  dsa · zziplib · opensuse · tumbleweed
[zziplib-devel]Unknown
Source package: [zziplib]
Details (1)
- 0.13.80-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 0.13.72-3.1
  Version impact unknown
  dsa · zziplib · opensuse · tumbleweed
[zziplib-devel-32bit]Unknown
Source package: [zziplib]
Details (1)
- 0.13.80-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 0.13.72-3.1
  Version impact unknown
  dsa · zziplib · opensuse · tumbleweed

[Debian 13 (Trixie)]

[libzzip-0-13t64]Fixed
Source package: [zziplib]
Details (2)
- 0.13.78+dfsg.1-0.1 · amd64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13
- 0.13.78+dfsg.1-0.1 · arm64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13
[libzzip-dev]Fixed
Source package: [zziplib]
Details (2)
- 0.13.78+dfsg.1-0.1 · amd64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13
- 0.13.78+dfsg.1-0.1 · arm64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13
[zziplib-bin]Fixed
Source package: [zziplib]
Details (2)
- 0.13.78+dfsg.1-0.1 · amd64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13
- 0.13.78+dfsg.1-0.1 · arm64 · trixie
  Fixed · Fixed: 0.13.78+dfsg.1-0.1
  dsa · zziplib · debian · 13

Observed: Oct 23, 2026, 5:48:54 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]