zziplib - Debian Package Tracker

general

source: zziplib (main)
version: 0.13.78+dfsg.1-0.2
maintainer: Scott Howard (DMD) (LowNMU)
arch: any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.13.62-3.3+deb11u1
oldstable: 0.13.72+dfsg.1-1.1
stable: 0.13.78+dfsg.1-0.1
testing: 0.13.78+dfsg.1-0.2
unstable: 0.13.78+dfsg.1-0.2

versioned links

0.13.62-3.3+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.13.72+dfsg.1-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.13.78+dfsg.1-0.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.13.78+dfsg.1-0.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libzzip-0-13t64
libzzip-dev
zziplib-bin (2 bugs: 0, 2, 0, 0)

action needed

A new upstream version is available: 0.13.80 high

A new upstream version 0.13.80 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-10-22 22:32

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-111141: zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
CVE-2026-111142: Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

Created: 2026-10-15 Last update: 2026-10-16 05:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-111141: zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
CVE-2026-111142: Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

Created: 2026-10-15 Last update: 2026-10-16 05:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-111141: zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
CVE-2026-111142: Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

Created: 2026-10-15 Last update: 2026-10-16 05:00

5 security issues in bookworm high

There are 5 open security issues in bookworm.

2 important issues:

CVE-2026-111141: zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
CVE-2026-111142: Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.

3 ignored issues:

CVE-2020-18770: An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.
CVE-2024-39133: Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.
CVE-2024-39134: A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.

Created: 2026-10-15 Last update: 2026-10-16 05:00

lintian reports 8 warnings normal

Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-09-28 Last update: 2026-05-16 03:00

debian/patches: 1 patch to forward upstream low

Among the 2 debian patches available in version 0.13.78+dfsg.1-0.2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-09-28 10:33

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2021-08-18 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-10-04] zziplib 0.13.78+dfsg.1-0.2 MIGRATED to testing (Debian testing watch)
[2025-09-27] Accepted zziplib 0.13.78+dfsg.1-0.2 (source) into unstable (Timo Röhling)
[2025-03-03] zziplib 0.13.78+dfsg.1-0.1 MIGRATED to testing (Debian testing watch)
[2025-02-25] Accepted zziplib 0.13.78+dfsg.1-0.1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2024-07-24] Accepted zziplib 0.13.72+dfsg.1-1.3 (source) into unstable (Lukas Märdian)
[2024-04-24] zziplib 0.13.72+dfsg.1-1.2 MIGRATED to testing (Debian testing watch)
[2024-03-01] Accepted zziplib 0.13.72+dfsg.1-1.2 (source) into unstable (Benjamin Drung)
[2024-02-05] Accepted zziplib 0.13.72+dfsg.1-1.2~exp1 (source) into experimental (Steve Langasek)
[2022-03-05] Accepted zziplib 0.13.62-3.2+deb10u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2022-03-05] Accepted zziplib 0.13.62-3.3+deb11u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Thorsten Alteholz)
[2021-12-27] Accepted zziplib 0.13.62-3.2~deb9u2 (source amd64) into oldoldstable (Thorsten Alteholz)
[2021-08-16] zziplib 0.13.72+dfsg.1-1.1 MIGRATED to testing (Debian testing watch)
[2021-06-21] Accepted zziplib 0.13.72+dfsg.1-1.1 (source) into unstable (Lukas Märdian) (signed by: Matthias Klose)
[2021-06-21] Accepted zziplib 0.13.72+dfsg.1-1 (source) into unstable (Lukas Märdian) (signed by: Matthias Klose)
[2021-03-13] zziplib 0.13.62-3.3 MIGRATED to testing (Debian testing watch)
[2021-03-04] Accepted zziplib 0.13.62-3.3 (source) into unstable (Matthias Klose)
[2020-06-28] Accepted zziplib 0.13.62-3+deb8u2 (source amd64) into oldoldstable (Thorsten Alteholz)
[2019-04-14] Accepted zziplib 0.13.62-3.2~deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2019-03-18] zziplib 0.13.62-3.2 MIGRATED to testing (Debian testing watch)
[2019-03-11] Accepted zziplib 0.13.62-3.2 (source) into unstable (Salvatore Bonaccorso)
[2018-02-20] Accepted zziplib 0.13.56-1.1+deb7u2 (source amd64) into oldoldstable (Chris Lamb)
[2017-06-24] Accepted zziplib 0.13.62-3+deb8u1 (source amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2017-06-20] Accepted zziplib 0.13.56-1.1+deb7u1 (source amd64) into oldoldstable (Thorsten Alteholz)
[2017-06-06] zziplib 0.13.62-3.1 MIGRATED to testing (Debian testing watch)
[2017-06-04] Accepted zziplib 0.13.62-3.1 (source amd64) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2014-08-30] zziplib 0.13.62-3 MIGRATED to testing (Britney)
[2014-08-25] Accepted zziplib 0.13.62-3 (source i386) into unstable (Scott Howard)
[2014-02-06] zziplib 0.13.62-2 MIGRATED to testing (Debian testing watch)
[2014-01-27] Accepted zziplib 0.13.62-2 (source i386) (Scott Howard)
[2014-01-21] Accepted zziplib 0.13.62-1 (source i386) (Scott Howard)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 8)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.13.78+dfsg.1-0.2
2 bugs