CVE-2017-5979 in ZZIPlib
Summary
by MITRE
The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/10/2025
The vulnerability identified as CVE-2017-5979 resides within the zziplib library version 0.13.62, specifically in the prescan_entry function located in the fseeko.c file. This flaw represents a critical security issue that can be exploited by remote attackers to execute a denial of service attack against systems utilizing this library. The vulnerability manifests when the library processes a specially crafted ZIP file that triggers a NULL pointer dereference, ultimately leading to a system crash. The zziplib library is widely used for reading and writing zip archives in various applications and systems, making this vulnerability particularly concerning for software that relies on zip file handling capabilities.
The technical root cause of this vulnerability stems from inadequate input validation within the prescan_entry function. When processing malformed or crafted ZIP archives, the function fails to properly check for NULL pointer conditions before attempting to dereference pointers, resulting in an unhandled exception that terminates the application. This behavior aligns with CWE-476, which describes NULL pointer dereference vulnerabilities that occur when a null pointer is dereferenced without proper validation. The flaw essentially allows an attacker to craft a ZIP file that contains malformed entries or structures that cause the library to attempt operations on uninitialized or null memory references, leading to immediate application termination.
From an operational perspective, this vulnerability presents significant risk to systems that depend on zziplib for zip file processing, including web applications, file servers, and content management systems. The remote exploitation capability means that attackers can trigger the denial of service condition without requiring local access or authentication, making it particularly dangerous in networked environments. The impact extends beyond simple service disruption as applications may crash repeatedly, potentially leading to resource exhaustion and making legitimate users unable to access services that depend on zip file functionality. This vulnerability is particularly concerning in automated systems or services that process user-uploaded files, as it can be exploited to create persistent denial of service conditions.
The attack surface for this vulnerability encompasses any software that utilizes zziplib version 0.13.62 or earlier for zip file operations, including but not limited to web applications, backup systems, and file processing utilities. According to ATT&CK framework category T1499, this vulnerability represents a service disruption technique that can be used to deny availability of targeted services. Mitigation strategies should focus on immediate library version updates to 0.13.63 or later, which contain the necessary patches to address the NULL pointer dereference issue. Additionally, implementing input validation and sanitization measures for zip file processing, along with proper error handling and resource monitoring, can help reduce the impact of similar vulnerabilities. Organizations should also consider implementing sandboxing techniques for zip file processing and establishing robust incident response procedures to handle potential exploitation attempts.