Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3030 advisory.

  - Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite     loop, causing a denial of service. This is related to zipheadio.h:readUint32() and     zipfile.cpp:Zipfile::Zipfile(). (CVE-2019-13453)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4057-1 advisory.

    Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this     vulnerability to cause a denial of service or consume system resources. (CVE-2019-13453)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4055-1 advisory.

    Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker     could potentially use this vulnerability to cause a denial of service. (CVE-2019-13032)

    Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use     this vulnerability to write arbitrary files to the filesystem. (CVE-2019-13241)

    Mike Salvatore discovered that the version of Zipios included in FlightCrew mishandled certain malformed     ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system     resources. (CVE-2019-13453)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
161655	Debian DLA-3030-1 : zipios++ - LTS security update	Nessus	Debian Local Security Checks	medium
126747	Ubuntu 16.04 LTS / 18.04 LTS : Zipios vulnerability (USN-4057-1)	Nessus	Ubuntu Local Security Checks	medium
126745	Ubuntu 16.04 LTS / 18.04 LTS : flightcrew vulnerabilities (USN-4055-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-13453

medium

Tenable Plugins

medium

medium

high