GCVE - cpe:2.3:a:gdraheim:zziplib:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gdraheim:zziplib:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gdraheim (`b728be81-301e-59ad-99e3-d3a908571635`)
Product	Zziplib (`379efeaf-3295-5fb2-a9ff-aea87d1c4947`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/gdraheim/zziplib`	purl2cpe	2026-06-01 10:15:45.654971

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111142`	vulnerable	2026-11-03 10:16:11.631695	Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst MEDIUM (5.5) Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application. Published: 2026-10-15T18:57:33.992Z Updated: 2026-10-16T17:10:35.100Z Open on db.gcve.eu Reference links https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-read https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L420-L497 https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/mmapped.c#L323-L352 https://github.com/gdraheim/zziplib https://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-disk-findfirst	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-111141`	vulnerable	2026-11-03 10:16:10.837016	zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing MEDIUM (4.7) zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process. Published: 2026-10-15T18:57:33.318Z Updated: 2026-10-15T19:46:48.484Z Open on db.gcve.eu Reference links https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-read https://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/zip.c#L530-L558 https://github.com/gdraheim/zziplib https://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-parse-root-directory-zip64-parsing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-16548`	vulnerable	2026-06-08 05:11:05.027704	Details available An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:24:32.976Z Open on db.gcve.eu Reference links https://github.com/gdraheim/zziplib/issues/58 https://access.redhat.com/errata/RHSA-2019:2196 http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00065.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00066.html https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Zziplib

Notes

PURL mappings

Vulnerability references

Contribute