Bug #75319 [Opn->Fbk]: Libzip 1.1.2 Security Vulnerability

Edit report at https://bugs.php.net/bug.php?id=75319&edit=1 ID: 75319 Updated by: ab@php.net Reported by: scott dot a dot andrews at gmail dot com Summary: Libzip 1.1.2 Security Vulnerability -Status: Open +Status: Feedback Type: Bug Package: Zip Related Operating System: Windows PHP Version: 7.1.10 Block user comment: N Private report: N New Comment: Thanks for the report. Please provide a link to the corresponding CVE. Thanks. Previous Comments: ------------------------------------------------------------------------ [2017-10-05 13:48:16] scott dot a dot andrews at gmail dot com Description: ------------ The version of Libzip included in 7.1.10 has been identified as a HIGH vulnerability. Libzip: zip_dirent.c Double Free Vulnerability Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors. This vulnerability was identified because (1) the detected version of Libzip, 1.1.2, is less than or equal to 1.2.11 In your next release, please upgrade Libzip to at least 1.2.11 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75319&edit=1