Bug#932556: zipios++: CVE-2019-13453

[Salvatore Bonaccorso <carnil@debian.org>]

Source: zipios++
Version: 0.1.5.9+cvs.2007.04.28-10
Severity: important
Tags: security upstream
Control: found -1 0.1.5.9+cvs.2007.04.28-6

Hi,

The following vulnerability was published for zipios++.

CVE-2019-13453[0]:
| Zipios before 0.1.7 does not properly handle certain malformed zip
| archives and can go into an infinite loop, causing a denial of
| service. This is related to zipheadio.h:readUint32() and
| zipfile.cpp:Zipfile::Zipfile().


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13453
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13453
[1] https://sourceforge.net/p/zipios/news/2019/07/version-017-cve-/
[2] https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/

Regards,
Salvatore