CVE-2017-5974

What it actually does

Heap-based buffer overflow in the __zzip_get32 function allows a malformed ZIP archive to trigger memory corruption leading to process crash.

Why it matters to the business

Attackers can crash applications that process untrusted ZIP files, causing service disruption and potential loss of availability for systems relying on the vulnerable library; the issue has publicly available exploit code despite its age.

How an attack unfolds

An attacker crafts a malicious ZIP file that triggers the overflow in __zzip_get32 when parsed; the file is delivered to the target application (for example via download or attachment), causing immediate denial of service upon processing.

How to fix it

Upgrade affected packages to the fixed versions provided by vendors; for newrelic-infrastructure-agent-1.43 (Chainguard) update to 1.43.2-r10 or later. Rebuild and redeploy any applications that statically link the vulnerable zziplib library.

How to confirm the fix worked

Confirm the installed zziplib or dependent package version meets or exceeds the fixed release; re-test parsing of the previously crashing ZIP sample in an isolated environment to verify absence of crash.

Typical attack path

1. Create specially malformed ZIP archive targeting __zzip_get32
2. Deliver archive to victim application or system that uses zziplib
3. Trigger parsing of the archive through normal file handling
4. Observe resulting crash and service interruption

How to detect it

Review application and system logs for unexpected crashes or segmentation faults when processing ZIP files; look for process terminations correlated with file ingestion timestamps.

What your security team should do

• Immediately update all instances of the vulnerable library or dependent products to the stated fixed versions
• Scan build pipelines and container images for the affected zziplib versions
• Prioritize patching in environments that process untrusted ZIP content