Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 4 articles for you...
197
security advisorydenial of serviceremote attackDebian LTS: DLA-2858-1 Critical Libzip Denial Of Service Update
An issue has been found in libzip, a library for reading, creating, and modifying zip archives. Crafted ZIP archives could allow remote attackers to cause denial of . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2858-1
Dec 27, 2021
•Critical
Debian LTS
89
security advisoryfedoracriticalFedora 30: 2019-94fb5d75e6 Critical: Libzip AES Encryption Bug
**Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-94fb5d75e6 2019-03-29 19:07:28.731711 --------------------------------------------------------------------------------Name : libzip Product : Fedora 30 Version : 1.5.2 Release : 1.fc30 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: **Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations. --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-94fb5d75e6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 29, 2019
•Critical
Fedora
89
security advisoryupdateencryptionFedora 29: FEDORA-2019-615e060d4e Critical: libzip AES Fix
**Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-615e060d4e 2019-03-21 21:46:40.166824 --------------------------------------------------------------------------------Name : libzip Product : Fedora 29 Version : 1.5.2 Release : 1.fc29 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: **Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations. --------------------------------------------------------------------------------ChangeLog: * Tue Mar 12 2019 Remi Collet - 1.5.2-1 - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-615e060d4e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 21, 2019
•Critical
Fedora
89
security advisoryFedoraupdate informationFedora 28: libzip Security Update - AES Encryption Issues Fixed
**Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-0b73bd3e5d 2019-03-21 21:08:05.034420 --------------------------------------------------------------------------------Name : libzip Product : Fedora 28 Version : 1.5.2 Release : 1.fc28 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: **Version 1.5.2** * Fix bug in AES encryption affecting certain file sizes * Keep file permissions when modifying zip archives * Support systems with small stack size. * Add nullability annotations. --------------------------------------------------------------------------------ChangeLog: * Tue Mar 12 2019 Remi Collet - 1.5.2-1 - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-0b73bd3e5d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 21, 2019
•Critical
Fedora
198
security advisoryhigh severityarbitrary code executionArch Linux 201711-13 High Severity: libzip Arbitrary Code Execution
The package libzip before version 1.3.0-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-201711-13 ========================================= Severity: High Date : 2017-11-07 CVE-ID : CVE-2017-12858 Package : libzip Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-390 Summary ====== The package libzip before version 1.3.0-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 1.3.0-1. # pacman -Syu "libzip> =1.3.0-1" The problem has been fixed upstream in version 1.3.0. Workaround ========= None. Description ========== Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to execute arbitrary code via a crafted zip file. Impact ===== A remote attacker can execute arbitrary code on the affected host by tricking the user or an application using libzip into opening a crafted zip file. References ========= https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796 https://security.archlinux.org/CVE-2017-12858 . Arch Linux Notification regarding critical arbitrary code execution vulnerability found in libzip versions earlier than 1.3.0-1; immediate upgrade advised.. libzip update, arch linux security, code execution threat. . Severity: Important. LinuxSecurity.com Team
Nov 08, 2017
•Important
ArchLinux
89
security advisorysoftware updateFedoraFedora 27: mingw-libzip Security Update For Memory Allocation Issue
Update to version 1.3.0, see https://libzip.org/news/ for details. ---- This update backports security fix for CVE-2017-14107.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-d5487d0f80 2017-09-30 05:57:53.234970 --------------------------------------------------------------------------------Name : mingw-libzip Product : Fedora 27 Version : 1.3.0 Release : 1.fc27 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: Update to version 1.3.0, see https://libzip.org/news/ for details. ----This update backports security fix for CVE-2017-14107. --------------------------------------------------------------------------------References: [ 1 ] Bug #1489000 - CVE-2017-14107 libzip: Memory allocation failure in _zip_cdir_grow function https://bugzilla.redhat.com/show_bug.cgi?id=1489000 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade mingw-libzip' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 30, 2017
•Critical
Fedora
89
security advisorycriticalsoftware updateFedora 27: 2017-7bd193c0ed Critical: Libzip Double Free Security Update
**Version 1.3.0** It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are: * Support bzip2 compressed zip archives * Improve file progress callback code * Fix zip_fdopen() * CVE-2017-12858: Fix double free(). * CVE-2017-14107: Improve EOCD64 parsing.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-7bd193c0ed 2017-09-30 05:57:53.205860 --------------------------------------------------------------------------------Name : libzip Product : Fedora 27 Version : 1.3.0 Release : 1.fc27 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: **Version 1.3.0** It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are: * Support bzip2 compressed zip archives * Improve file progress callback code * Fix zip_fdopen() * CVE-2017-12858: Fix double free(). * CVE-2017-14107: Improve EOCD64 parsing. --------------------------------------------------------------------------------References: [ 1 ] Bug #1484515 - CVE-2017-12858 libzip: Double free in _zip_dirent_read function in zip_dirent.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1484515 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade libzip' at the command line. For moreinformation, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 30, 2017
•Critical
Fedora
89
security advisorycriticalFedoraFedora 26: Libzip Update Critical Security Issues Resolved
**Version 1.3.0** It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are: * Support bzip2 compressed zip archives * Improve file progress callback code * Fix zip_fdopen() * CVE-2017-12858: Fix double free(). * CVE-2017-14107: Improve EOCD64 parsing.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-840db88351 2017-09-06 13:04:04.357194 --------------------------------------------------------------------------------Name : libzip Product : Fedora 26 Version : 1.3.0 Release : 1.fc26 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. --------------------------------------------------------------------------------Update Information: **Version 1.3.0** It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are: * Support bzip2 compressed zip archives * Improve file progress callback code * Fix zip_fdopen() * CVE-2017-12858: Fix double free(). * CVE-2017-14107: Improve EOCD64 parsing. --------------------------------------------------------------------------------References: [ 1 ] Bug #1484515 - CVE-2017-12858 libzip: Double free in _zip_dirent_read function in zip_dirent.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1484515 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade libzip' at the command line. For moreinformation, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 06, 2017
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!