CVE-2024-39134

What it actually does

Stack buffer overflow in __zzip_fetch_disk_trailer() at /zzip/zip.c allows crafted input to corrupt stack memory and crash the process.

Why it matters to the business

Applications that parse ZIP archives with this library can be forced offline, interrupting any service or workflow that depends on ZIP handling.

How an attack unfolds

An attacker supplies a malicious ZIP archive that reaches the vulnerable trailer-parsing routine; the overflow occurs during disk-trailer processing and terminates the application.

How to fix it

Upgrade zziplib to a version containing the fix for the stack buffer overflow; rebuild and redeploy any dependent software.

How to confirm the fix worked

Confirm the installed zziplib version is newer than 0.13.77, then exercise the library with both benign and malformed ZIP inputs to verify no crash occurs.

Typical attack path

1. Locate a reachable service or tool that uses zziplib to open ZIP files
2. Craft a ZIP archive that triggers the buffer overflow in __zzip_fetch_disk_trailer
3. Deliver the archive to the target for parsing
4. Cause the application to crash, resulting in denial of service

How to detect it

Review application and system logs for segmentation faults or abrupt terminations immediately after ZIP file processing; correlate with file-upload or archive-extraction events.

What your security team should do

• Identify all products and containers that link against zziplib and schedule updates
• Add zziplib to the vulnerability scanning inventory with a high-severity rule
• Consider sandboxing or replacing ZIP parsing code until the library is patched