Ubuntu 17.04, 16.10, 16.04 LTS Security Advisory: Zziplib DoS

ubuntu

June 15, 2017

zziplib could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

zziplib could be made to crash or run programs as your login if it opened a

specially crafted file.

Software Description:

- zziplib: library providing read access on ZIP-archives

Details:

Agostino Sarubbo discovered that zziplib incorrectly handled certain

malformed ZIP files. If a user or automated system were tricked into

opening a specially crafted ZIP file, a remote attacker could cause zziplib

to crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics Covered

security advisory denial of service ubuntu software bug zziplib

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  libzzip-0-13                    0.13.62-3ubuntu0.17.04.1

Ubuntu 16.10:
  libzzip-0-13                    0.13.62-3ubuntu0.16.10.1

Ubuntu 16.04 LTS:
  libzzip-0-13                    0.13.62-3ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  libzzip-0-13                    0.13.62-2ubuntu0.1

In general, a standard system update will make all the necessary changes.