CVE-2019-17582

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796Patch, Third Party Advisory
https://github.com/nih-at/libzip/issues/5Third Party Advisory
https://libzip.org/libzip-discuss/Release Notes, Vendor Advisory
https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796Patch, Third Party Advisory
https://github.com/nih-at/libzip/issues/5Third Party Advisory
https://libzip.org/libzip-discuss/Release Notes, Vendor Advisory

Timeline

Published: Feb 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-175837.5idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonst CVE-2019-175847.5The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions CVE-2019-17595.3A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow CVE-2019-175908.8The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper w CVE-2019-175927.5The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malfo CVE-2019-175938.8JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.CVE-2019-175945.3There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-201 CVE-2019-175955.4There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012 CVE-2019-175967.5Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There a CVE-2019-175987.5An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy CVE-2019-175996.1The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact i CVE-2019-17605.9A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause t