CVE-2020-18442

Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
Affected Products (NVD)
VendorProductVersion
gdraheimzziplib
0.13.69
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
zziplib
bookworm
0.13.72+dfsg.1-1.1
fixed
bullseye
0.13.62-3.3+deb11u1
fixed
sid
0.13.72+dfsg.1-1.3
fixed
trixie
0.13.72+dfsg.1-1.2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zziplib
bionic
Fixed 0.13.62-3.1ubuntu0.18.04.1+esm1
released
focal
Fixed 0.13.62-3.2ubuntu1.1
released
groovy
ignored
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
ignored
lunar
not-affected
trusty
dne
xenial
Fixed 0.13.62-3ubuntu0.16.04.2+esm1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libzzip-0-13
suse enterprise desktop 15 SP5
0.13.69-150000.3.17.1
fixed
suse enterprise sap 15 SP5
0.13.69-150000.3.17.1
fixed
suse enterprise server 15 SP4
0.13.69-150000.3.17.1
fixed
suse enterprise server 15 SP5
0.13.69-150000.3.17.1
fixed
zziplib-devel
suse enterprise desktop 15 SP5
0.13.69-150000.3.17.1
fixed
suse enterprise sap 15 SP5
0.13.69-150000.3.17.1
fixed
suse enterprise server 15 SP4
0.13.69-150000.3.17.1
fixed
suse enterprise server 15 SP5
0.13.69-150000.3.17.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
zziplib
RHEL 8
0:0.13.68-9.el8
fixed
zziplib-devel
RHEL 8
0:0.13.68-9.el8
fixed
zziplib-utils
RHEL 8
0:0.13.68-9.el8
fixed
Common Weakness Enumeration
References
https://github.com/gdraheim/zziplib/issues/68
https://lists.debian.org/debian-lts-announce/2021/12/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCFYD46OY4VAGJ4UX7IFOH5SHD4UW4ZA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVANTEBDQGOIPC5KCEVAGA5KT4KKTGWB/
https://github.com/gdraheim/zziplib/issues/68
https://lists.debian.org/debian-lts-announce/2021/12/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCFYD46OY4VAGJ4UX7IFOH5SHD4UW4ZA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVANTEBDQGOIPC5KCEVAGA5KT4KKTGWB/