zziplib: Multiple vulnerabilities (CVE-2018-16548, CVE-2018-17828)

CVE-2018-16548: Memory leak triggered in the function __zzip_parse_root_directory in zip.c

An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c, which will lead to a denial of service attack.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-16548
• https://github.com/gdraheim/zziplib/issues/58

CVE-2018-17828: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-17828
• https://github.com/gdraheim/zziplib/issues/62

Affected branches:

• master (c900bcd2)
• 3.10-stable (8068beb7)