{"id":"CVE-2019-17582","details":"A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states \"This use-after-free is triggered prior to the double free reported in CVE-2017-12858.\"","modified":"2026-07-08T17:16:50.791401Z","published":"2021-02-09T19:15:12.553Z","references":[{"type":"ADVISORY","url":"https://github.com/nih-at/libzip/issues/5"},{"type":"ADVISORY","url":"https://libzip.org/libzip-discuss/"},{"type":"FIX","url":"https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nih-at/libzip","events":[{"introduced":"a23ac8a766c556827255111eb35ba928641efbc8"},{"last_affected":"a23ac8a766c556827255111eb35ba928641efbc8"},{"fixed":"2217022b7d1142738656d891e00b3d2d9179b796"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:libzip:libzip:1.2.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.2.0"},{"last_affected":"1.2.0"}]}}],"versions":["1.2.0","rel-1-2-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17582.json","vanir_signatures_modified":"2026-07-08T17:16:50Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796","target":{"file":"lib/zip_dirent.c","function":"_zip_dirent_read"},"deprecated":false,"digest":{"function_hash":"247741707400283749085108019441784905923","length":5237},"id":"CVE-2019-17582-11de36c1"},{"signature_version":"v1","source":"https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796","target":{"file":"lib/zip_dirent.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126407887668340329650951841643656814806","79489290485161336371396243068446216870","103867276804264513481566455227706953226","200745644596356662579889932048953027052","18703439355701899585658934728937768609","10360732491339512210894939584152610856"]},"id":"CVE-2019-17582-f2d51449","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}