NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
Résumé
NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exists in NanaZip’s .NET Single File Application parser. A crafted bundle can force an integer underflow in header-size calculation and trigger an unbounded memory allocation attempt during archive open. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov