CVE-2017-14107

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

• CWE-770

• https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/Patch, Third Party Advisory, VDB Entry
• https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/12/msg00022.htmlMailing List, Third Party Advisory
• https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/Patch, Third Party Advisory, VDB Entry
• https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/12/msg00022.htmlMailing List, Third Party Advisory

Published

Sep 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14100In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14…
• CVE-2017-14101A security researcher found an XML External Entity (XXE) vul…
• CVE-2017-14102MIMEDefang 2.80 and earlier creates a PID file after droppin…
• CVE-2017-14103The ReadJNGImage and ReadOneJNGImage functions in coders/png…
• CVE-2017-14105HiveManager Classic through 8.1r1 allows arbitrary JSP code …
• CVE-2017-14106The tcp_disconnect function in net/ipv4/tcp.c in the Linux k…
• CVE-2017-14108libgedit.a in GNOME gedit through 3.22.1 allows remote attac…
• CVE-2017-1411IBM Security Identity Governance Virtual Appliance 5.2 throu…5.9
• CVE-2017-14111The workstation logging function in Philips IntelliSpace Car…
• CVE-2017-14113Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-14114RTPproxy through 2.2.alpha.20160822 has a NAT feature that r…
• CVE-2017-14115The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 an…