----------------------------------------------------------------------

Want a new job?
http://secunia.com/secunia_vacancies/

Secunia is looking for new researchers with a reversing background
and experience in writing exploit code:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/
http://secunia.com/Disassembling_og_Reversing/

----------------------------------------------------------------------

TITLE:
ZZIPlib Library "zzip_open_shared_io()" Filename Buffer Overflow

SECUNIA ADVISORY ID:
SA24586

VERIFY ADVISORY:
http://secunia.com/advisories/24586/

CRITICAL:
Less critical

IMPACT:
Privilege escalation, System access

WHERE:
>From remote

SOFTWARE:
ZZIPLib Library 0.13.x
http://secunia.com/product/13699/

DESCRIPTION:
dmcox dmcox  has reported a vulnerability in ZZIPlib Library, which
potentially can be exploited by malicious people to gain escalated
privileges or compromise a vulnerable system.

The vulnerability is caused due to a boundary error in
"zzip_open_shared_io()" within zzip/file.c when processing arguments.
This can be exploited to cause a stack-based buffer overflow via an
overly long string passed as the filename argument to the said
function.

Successful exploitation may allow execution of arbitrary code.

NOTE: Applications using this library may also be affected.

SOLUTION:
Update to version 0.13.49.

PROVIDED AND/OR DISCOVERED BY:
dmcox dmcox

ORIGINAL ADVISORY:
http://www.securitylab.ru/forum/read.php?FID=21&TID=40858&MID=326187

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------