Debian Bug report logs - #903196
zip: CVE-2018-13410

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: zip: CVE-2018-13410

Date: Sat, 07 Jul 2018 14:19:08 +0200

Source: zip
Version: 3.0-11
Severity: normal
Tags: security upstream

Hi,

The following vulnerability was published for zip. Note it is really
disputed as security issue, filling this bug only for tracking the
underlying bug in case it get's fixed. A possible attack scenario
would involve an untrusted party which controls the -TT value. Still
fill a but for tracking the bug/issue.

CVE-2018-13410[0]:
| ** <A HREF="https://cve.mitre.org/about/faqs.html#disputed_signify_in_cve_entry">DISPUTED</A> ** Info-ZIP Zip 3.0, when the -T and -TT command-line
| options are used, allows attackers to cause a denial of service
| (invalid free and application crash) or possibly have unspecified other
| impact because of an off-by-one error. NOTE: it is unclear whether
| there are realistic scenarios in which an untrusted party controls the
| -TT value, given that the entire purpose of -TT is execution of
| arbitrary commands.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-13410
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13410
[1] http://seclists.org/fulldisclosure/2018/Jul/24

Regards,
Salvatore

Message #10 received at 903196@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Salvatore Bonaccorso <carnil@debian.org>, 903196@bugs.debian.org

Subject: Re: Bug#903196: zip: CVE-2018-13410

Date: Sat, 7 Jul 2018 14:35:41 +0200

On Sat, Jul 07, 2018 at 02:19:08PM +0200, Salvatore Bonaccorso wrote:
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2018-13410
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13410
> [1] http://seclists.org/fulldisclosure/2018/Jul/24

Thank you. I'll start by contacting whoever is in charge of
the phpbb discussion forum, because it's currently down :-(

Message #17 received at 903196-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 903196-close@bugs.debian.org

Subject: Bug#903196: fixed in zip 3.0-15

Date: Fri, 25 Apr 2025 21:51:50 +0000

[Message part 1 (text/plain, inline)]

Source: zip
Source-Version: 3.0-15
Done: Santiago Vila <sanvila@debian.org>

We believe that the bug you reported is fixed in the latest version of
zip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 903196@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated zip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 25 Apr 2025 22:55:00 +0200
Source: zip
Architecture: source
Version: 3.0-15
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Closes: 903196 1005943 1077054 1092811 1093629
Changes:
 zip (3.0-15) unstable; urgency=medium
 .
   * Add debian/source/lintian-overrides for *.a files.
   * Fix manpage typo: RISC OS/2 -> OS/2. Closes: #1092811.
   * Fix buffer overflow when filename contains unicode characters.
     Closes: #1077054, #1093629.
   * Fix buffer overflow when using '-T -TT'. Closes: #903196, #1093629.
     This is CVE-2018-13410. CVE note: Negligible security impact, would
     involve that a untrusted party controls the -TT value.
   * Fix symlink update detection. Closes: #1005943.
   * Add Vcs-Git and Vcs-Browser fields.
   * Update Standards-Version.
   * Add debian/salsa-ci.yml.
Checksums-Sha1:
 cc6549439ec4ab30e1a04729cc3d0fb22b648ba7 1439 zip_3.0-15.dsc
 f98e04fd7b5cb0162d921f516358ac507814d7c2 10692 zip_3.0-15.debian.tar.xz
 74fd1a949eebf70dfc6d69c172e0a4a8d844368f 4918 zip_3.0-15_source.buildinfo
Checksums-Sha256:
 1cee3f25b904023d12c46e55628a79328ce21e47e32737358b3cd99233b5bc6d 1439 zip_3.0-15.dsc
 6dc1711c67640e8d1dee867ff53e84387ddb980c40885bd088ac98c330bffce9 10692 zip_3.0-15.debian.tar.xz
 2223f20d91ef323d639954d89994f3368083df343189323a836b73094599de61 4918 zip_3.0-15_source.buildinfo
Files:
 8ac72e7c3b11ac827f0b1e1cb58770da 1439 utils optional zip_3.0-15.dsc
 99f46dbcd62fa7f4a8b49236fa695376 10692 utils optional zip_3.0-15.debian.tar.xz
 4ee7d2f6b3a9e09e49c3030aa5dbe046 4918 utils optional zip_3.0-15_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmgMAPAACgkQQc5/C58b
izKmRAf+Py7ur++p7Taeb7rOFu6l3/KPznjjW7eRsmixHVCmB33hqPPsXN+T1vwA
JM1mOJFw4igiRs4JMGIzaFXrw0mwXBoEUMW/0g6PiTiR3seWak73qbard1RmgjAQ
+DJ0Wd77WY7CpoQWPEF4oORDs5Ia77bfrdzHJxTJHVjwgxzWzJUXB1kg0r+shtW2
eFIYayFpVJydFEmCRzlC1oQrelhSmSMPiv1kXBtKzCURNuioowiW8Gh0fZsIq8KD
fPMF+cfKJeLYs+vgBmoZGQzXoZkBSylMdEjLL0K1rTdzh51948ZzzgnPzWxmExua
MZTPBG8EOBXUmZ2MHrvKt1NcK/5QcQ==
=9sE8
-----END PGP SIGNATURE-----

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.