Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 30 articles for you...
203
security advisorydenial of servicecritical issueMageia 9 MGASA-2024-0289 Critical: zziplib Denial of Service
A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c. (CVE-2024-39134) References: . MGASA-2024-0289 - Updated zziplib packages fix security vulnerability Publication date: 10 Sep 2024 URL: https://advisories.mageia.org/MGASA-2024-0289.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-39134 A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c. (CVE-2024-39134) References: - https://bugs.mageia.org/show_bug.cgi?id=33527 - https://lists.suse.com/pipermail/sle-security-updates/2024-August/019205.html - https://www.cve.org/CVERecord?id=CVE-2024-39134 SRPMS: - 9/core/zziplib-0.13.72-2.2.mga9 . The Mageia security advisory MGASA-2024-0290 tackles a critical vulnerability in zziplib, which involves a stack buffer overflow, aiming to prevent potential denial of service incidents.. zziplib security, buffer overflow fix, mageia advisory, dos threat, security update. . Severity: Critical. LinuxSecurity.com Team
Sep 10, 2024
•Critical
Mageia
100
security advisorybuffer overflowSUSESUSE: 2024:3083-1 Moderate: Zziplib Buffer Overflow Issue
* bsc#1227178 Cross-References: * CVE-2024-39134 . # Security update for zziplib Announcement ID: SUSE-SU-2024:3083-1 Rating: moderate References: * bsc#1227178 Cross-References: * CVE-2024-39134 CVSS scores: * CVE-2024-39134 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for zziplib fixes the following issues: * CVE-2024-39134: Fixed a stack buffer overflow via the __zzip_fetch_disk_trailer() (bsc#1227178) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3083=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-3083=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * zziplib-devel-debuginfo-0.13.69-150000.3.20.1 * zziplib-devel-0.13.69-150000.3.20.1 * libzzip-0-13-debuginfo-0.13.69-150000.3.20.1 * libzzip-0-13-0.13.69-150000.3.20.1 * zziplib-debugsource-0.13.69-150000.3.20.1 * openSUSE Leap 15.5 (x86_64) * libzzip-0-13-32bit-debuginfo-0.13.69-150000.3.20.1 * zziplib-devel-32bit-debuginfo-0.13.69-150000.3.20.1 * zziplib-devel-32bit-0.13.69-150000.3.20.1 * libzzip-0-13-32bit-0.13.69-150000.3.20.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * zziplib-devel-debuginfo-0.13.69-150000.3.20.1 * zziplib-devel-0.13.69-150000.3.20.1 * libzzip-0-13-debuginfo-0.13.69-150000.3.20.1 *libzzip-0-13-0.13.69-150000.3.20.1 * zziplib-debugsource-0.13.69-150000.3.20.1 ## References: * https://www.suse.com/security/cve/CVE-2024-39134.html * https://bugzilla.suse.com/show_bug.cgi?id=1227178 . A moderate stack buffer overflow vulnerability in zziplib affects all versions up to 0.10.0, requiring immediate updates for system integrity. zziplib update,SUSE advisory,stack overflow security,buffer overflow patch. . LinuxSecurity.com Team
Sep 02, 2024
SuSE
100
security advisorymoderatebuffer overflowSUSE: 2024:2930-1 Critical: Zlib Memory Leak Notification and Advisory
* bsc#1227178 Cross-References: * CVE-2024-39134 . # Security update for zziplib Announcement ID: SUSE-SU-2024:2925-1 Rating: moderate References: * bsc#1227178 Cross-References: * CVE-2024-39134 CVSS scores: * CVE-2024-39134 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for zziplib fixes the following issues: * CVE-2024-39134: Fixed a stack buffer overflow via the __zzip_fetch_disk_trailer() (bsc#1227178) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-2925=1 openSUSE-SLE-15.6-2024-2925=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-2925=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libzzip-0-13-0.13.72-150600.4.3.1 * libzzip-0-13-debuginfo-0.13.72-150600.4.3.1 * zziplib-debugsource-0.13.72-150600.4.3.1 * zziplib-devel-0.13.72-150600.4.3.1 * zziplib-devel-debuginfo-0.13.72-150600.4.3.1 * openSUSE Leap 15.6 (x86_64) * zziplib-devel-32bit-0.13.72-150600.4.3.1 * libzzip-0-13-32bit-0.13.72-150600.4.3.1 * zziplib-devel-32bit-debuginfo-0.13.72-150600.4.3.1 * libzzip-0-13-32bit-debuginfo-0.13.72-150600.4.3.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libzzip-0-13-64bit-debuginfo-0.13.72-150600.4.3.1 * libzzip-0-13-64bit-0.13.72-150600.4.3.1 * zziplib-devel-64bit-debuginfo-0.13.72-150600.4.3.1 * zziplib-devel-64bit-0.13.72-150600.4.3.1 * Basesystem Module 15-SP6(aarch64 ppc64le s390x x86_64) * libzzip-0-13-0.13.72-150600.4.3.1 * libzzip-0-13-debuginfo-0.13.72-150600.4.3.1 * zziplib-debugsource-0.13.72-150600.4.3.1 * zziplib-devel-0.13.72-150600.4.3.1 * zziplib-devel-debuginfo-0.13.72-150600.4.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-39134.html * https://bugzilla.suse.com/show_bug.cgi?id=1227178 . SUSE releases a critical patch for zziplib fixing a significant risk of stack buffer overflow within the application.. SUSE Linux, Zziplib Patch, Security Update, Buffer Overflow Fix. . Severity: Important. LinuxSecurity.com Team
Aug 15, 2024
•Important
SuSE
100
security advisorymoderatebuffer overflowSUSE: 2024:2926-1 Moderate: zziplib Buffer Overflow Fix
* bsc#1227178 Cross-References: * CVE-2024-39134 . # Security update for zziplib Announcement ID: SUSE-SU-2024:2926-1 Rating: moderate References: * bsc#1227178 Cross-References: * CVE-2024-39134 CVSS scores: * CVE-2024-39134 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for zziplib fixes the following issues: * CVE-2024-39134: Fixed a stack buffer overflow via the __zzip_fetch_disk_trailer() (bsc#1227178) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-2926=1 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 zypper in -t patch SUSE-SLE-WE-12-SP5-2024-2926=1 ## Package List: * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64) * zziplib-debugsource-0.13.67-10.39.1 * zziplib-devel-0.13.67-10.39.1 * zziplib-devel-debuginfo-0.13.67-10.39.1 * libzzip-0-13-0.13.67-10.39.1 * libzzip-0-13-debuginfo-0.13.67-10.39.1 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 (x86_64) * libzzip-0-13-0.13.67-10.39.1 * zziplib-debugsource-0.13.67-10.39.1 * libzzip-0-13-debuginfo-0.13.67-10.39.1 ## References: * https://www.suse.com/security/cve/CVE-2024-39134.html * https://bugzilla.suse.com/show_bug.cgi?id=1227178 . SUSE enhances zziplib to address a buffer overflow vulnerability. Apply the necessary updates via suggestedtechniques for impacted software.. SUSE Security Update, zziplib Patch, Buffer Overflow Fix, Linux Enterprise. . LinuxSecurity.com Team
Aug 15, 2024
SuSE
100
security advisorydenial of servicelow severitySUSE: 2024:0961-1 Low Severity: zziplib Denial of Service Patch
* bsc#1214577 Cross-References: * CVE-2020-18770 . # Security update for zziplib Announcement ID: SUSE-SU-2024:0961-1 Rating: low References: * bsc#1214577 Cross-References: * CVE-2020-18770 CVSS scores: * CVE-2020-18770 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2020-18770 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for zziplib fixes the following issues: * CVE-2020-18770: Fixed denial-of-service in function zzip_disk_entry_to_file_header in mmapped.c (bsc#1214577). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-961=1 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 zypper in -t patch SUSE-SLE-WE-12-SP5-2024-961=1 ## Package List: * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64) * libzzip-0-13-debuginfo-0.13.67-10.36.1 * zziplib-devel-0.13.67-10.36.1 * zziplib-devel-debuginfo-0.13.67-10.36.1 * zziplib-debugsource-0.13.67-10.36.1 * libzzip-0-13-0.13.67-10.36.1 * SUSE Linux Enterprise Workstation Extension 12 12-SP5 (x86_64) * libzzip-0-13-debuginfo-0.13.67-10.36.1 * libzzip-0-13-0.13.67-10.36.1 * zziplib-debugsource-0.13.67-10.36.1 ## References: * https://www.suse.com/security/cve/CVE-2020-18770.html * https://bugzilla.suse.com/show_bug.cgi?id=1214577 . SUSE-SU-2024:0962-1 securitypatch resolves vulnerability in libxml2. Update through YaST or zypper.. SUSE Security Update, zziplib Denial of Service, SUSE Linux Update. . Severity: Low. LinuxSecurity.com Team
Mar 22, 2024
•Low
SuSE
100
security advisorymoderatedenial of serviceSUSE: 2024:0970-1 Moderate: Zziplib Denial Of Service & Infinite Loop
* bsc#1154002 * bsc#1187526 * bsc#1214577 Cross-References: . # Security update for zziplib Announcement ID: SUSE-SU-2024:0970-1 Rating: moderate References: * bsc#1154002 * bsc#1187526 * bsc#1214577 Cross-References: * CVE-2020-18442 * CVE-2020-18770 CVSS scores: * CVE-2020-18442 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2020-18442 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2020-18770 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2020-18770 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities and has one security fix can now be installed. ## Description: This update for zziplib fixes the following issues: Security issue fixed: * CVE-2020-18442: Fixed infinite loop in zzip_file_read() as used in unzzip_cat_file() (bsc#1187526). * CVE-2020-18770: Fixed denial-of-service in function zzip_disk_entry_to_file_header in mmapped.c (bsc#1214577). Non-security issue fixed: * Implement an error message with a condition by checking the return value of a function call. (bsc#1154002) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-970=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-970=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * zziplib-debugsource-0.13.69-150000.3.17.1 * libzzip-0-13-debuginfo-0.13.69-150000.3.17.1 * libzzip-0-13-0.13.69-150000.3.17.1 * zziplib-devel-0.13.69-150000.3.17.1 * zziplib-devel-debuginfo-0.13.69-150000.3.17.1 * openSUSE Leap 15.5 (x86_64) * zziplib-devel-32bit-debuginfo-0.13.69-150000.3.17.1 * libzzip-0-13-32bit-0.13.69-150000.3.17.1 * libzzip-0-13-32bit-debuginfo-0.13.69-150000.3.17.1 * zziplib-devel-32bit-0.13.69-150000.3.17.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * zziplib-debugsource-0.13.69-150000.3.17.1 * libzzip-0-13-debuginfo-0.13.69-150000.3.17.1 * libzzip-0-13-0.13.69-150000.3.17.1 * zziplib-devel-0.13.69-150000.3.17.1 * zziplib-devel-debuginfo-0.13.69-150000.3.17.1 ## References: * https://www.suse.com/security/cve/CVE-2020-18442.html * https://www.suse.com/security/cve/CVE-2020-18770.html * https://bugzilla.suse.com/show_bug.cgi?id=1154002 * https://bugzilla.suse.com/show_bug.cgi?id=1187526 * https://bugzilla.suse.com/show_bug.cgi?id=1214577 . Patches for zziplib to mitigate denial-of-service vulnerabilities and prevent infinite loop occurrences, crucial for maintaining system reliability and efficiency.. SUSE Security Advisory, Zziplib Update, Denial Of Service Fix. . LinuxSecurity.com Team
Mar 22, 2024
SuSE
89
security advisoryfedorasoftware fixFedora 35: 2022-737e44718a Moderate: Zziplib Infinite Loop Fix
Upstream version 0.13.72 Fixes CVE-2020-18442. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-737e44718a 2022-02-18 01:36:49.249212 --------------------------------------------------------------------------------Name : zziplib Product : Fedora 35 Version : 0.13.72 Release : 1.fc35 URL : Summary : Lightweight library to easily extract data from zip files Description : The zziplib library is intentionally lightweight, it offers the ability to easily extract data from files archived in a single zip file. Applications can bundle files into a single zip archive and access them. The implementation is based only on the (free) subset of compression with the zlib algorithm which is actually used by the zip/unzip tools. --------------------------------------------------------------------------------Update Information: Upstream version 0.13.72 Fixes CVE-2020-18442 --------------------------------------------------------------------------------ChangeLog: * Wed Feb 9 2022 Alexander Bokovoy - 0.13.72-1 - 0.13.72 - Fixes CVE-2020-18442 - Resolves: rhbz#1973831 - Switch build to CMake, drop 32-bit patches as checks integrated in CMake already --------------------------------------------------------------------------------References: [ 1 ] Bug #1973831 - CVE-2020-18442 zziplib: infinite loop via the return value of zzip_file_read() as used in unzzip_cat_file() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1973831 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-737e44718a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project canbe found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Feb 17, 2022
•Important
Fedora
89
security advisoryfedoracriticalFedora 34: FEDORA-2022-8109b472a3 Critical: zziplib Infinite Loop Fix
Upstream version 0.13.72 Fixes CVE-2020-18442. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-8109b472a3 2022-02-18 01:13:10.939561 --------------------------------------------------------------------------------Name : zziplib Product : Fedora 34 Version : 0.13.72 Release : 1.fc34 URL : Summary : Lightweight library to easily extract data from zip files Description : The zziplib library is intentionally lightweight, it offers the ability to easily extract data from files archived in a single zip file. Applications can bundle files into a single zip archive and access them. The implementation is based only on the (free) subset of compression with the zlib algorithm which is actually used by the zip/unzip tools. --------------------------------------------------------------------------------Update Information: Upstream version 0.13.72 Fixes CVE-2020-18442 --------------------------------------------------------------------------------ChangeLog: * Wed Feb 9 2022 Alexander Bokovoy - 0.13.72-1 - 0.13.72 - Fixes CVE-2020-18442 - Resolves: rhbz#1973831 - Switch build to CMake, drop 32-bit patches as checks integrated in CMake already --------------------------------------------------------------------------------References: [ 1 ] Bug #1973831 - CVE-2020-18442 zziplib: infinite loop via the return value of zzip_file_read() as used in unzzip_cat_file() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1973831 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-8109b472a3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project canbe found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Feb 17, 2022
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!