CVE-2017-14107

What it actually does

Mishandling of EOCD records in the _zip_read_eocd64 function causes excessive memory allocation in _zip_cdir_grow during processing of crafted ZIP archives, resulting in denial of service.

Why it matters to the business

Services and applications that parse untrusted ZIP archives may crash or become unresponsive, interrupting operations that depend on ZIP file handling in affected environments.

How an attack unfolds

An attacker creates a ZIP archive containing malformed EOCD records and supplies it to a target application using a vulnerable libzip version; when the archive is opened, the mishandled record triggers uncontrolled memory growth leading to allocation failure.

How to fix it

Upgrade libzip to version 1.3.0 or later; for Git-based builds apply commit 51ff59da3a8c7d3934e23aed70eb0347234a14c9. Ensure packages such as aws-flb-kinesis and aws-flb-kinesis-compat use versions marked fixed in 0.

How to confirm the fix worked

Confirm installed libzip version meets or exceeds 1.3.0; test affected applications against known malformed ZIP samples to verify absence of memory allocation crashes.

Typical attack path

1. Craft a ZIP archive with malformed EOCD records
2. Deliver the archive to an application that uses libzip to open ZIP files
3. Trigger opening of the archive via _zip_read_eocd64
4. Induce memory allocation failure in _zip_cdir_grow

How to detect it

Review application logs for memory allocation failures or crashes occurring during ZIP file processing; correlate with usage of libzip in file-handling workflows.

What your security team should do

• Prioritize updating all libzip instances to the fixed versions listed for each package
• Inventory dependencies to identify usage of vulnerable libzip across the environment
• Apply network or application-level controls to limit processing of untrusted ZIP archives until patched