{"id":"CVE-2017-14107","details":"The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.","modified":"2026-07-08T15:10:33.585625Z","published":"2017-09-01T17:29:00.260Z","related":["SUSE-SU-2017:2546-1","openSUSE-SU-2024:11018-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00022.html"},{"type":"FIX","url":"https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/"},{"type":"FIX","url":"https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nih-at/libzip","events":[{"introduced":"0"},{"fixed":"51ff59da3a8c7d3934e23aed70eb0347234a14c9"},{"fixed":"9b46957ec98d85a572e9ef98301247f39338a3b5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.3.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:libzip:libzip:*:*:*:*:*:*:*:*"}}],"versions":["rel-1-2-0","brian-gladman-fcrypt-2008-11-18","rel-1-1-3","rel-1-1-2","rel-1-1-1","rel-1-1","rel-1-0-1","rel-1-0","rel-1-0-beta1","rel-0-11-2","rel-0-11-1","rel-0-10","rel-0-9-3","rel-0-9-2","rel-0-9-1","rel-0-9","rel-0-8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14107.json","vanir_signatures_modified":"2026-07-08T15:10:33Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5","target":{"function":"_zip_read_eocd64","file":"lib/zip_open.c"},"deprecated":false,"digest":{"function_hash":"270634252082683356640149721446126711800","length":2463},"id":"CVE-2017-14107-32b145ed"},{"signature_version":"v1","source":"https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5","target":{"file":"lib/zip_open.c"},"deprecated":false,"digest":{"line_hashes":["165964108850227973857470887023903761180","96688641138386494289697648155179514093","45523777207728124008034808853355606263","224754828264554936099524097806032039924"],"threshold":0.9},"id":"CVE-2017-14107-ac68091e","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}