CVE-2012-1162: nih libzip

Vulnerability summary

CVE-2012-1162 is a high (CVSS 7.5) vulnerability in nih libzip. EPSS estimates a 4.03% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 12-07-2012
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct."

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.