CVE-2018-6381

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzip_disk_fread function (zzip/mmapped.c) because the size variable is not validated against the amount of file->stored data.

• CWE-119

• https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-6381
• https://github.com/gdraheim/zziplib/issues/12Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
• https://usn.ubuntu.com/3699-1/Third Party Advisory
• https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2018-6381
• https://github.com/gdraheim/zziplib/issues/12Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
• https://usn.ubuntu.com/3699-1/Third Party Advisory

Published

Jan 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6374The GUI component (aka PulseUI) in Pulse Secure Desktop Linu…
• CVE-2018-6376In Joomla! before 3.8.4, the lack of type casting of a varia…
• CVE-2018-6377In Joomla! before 3.8.4, inadequate input filtering in com_f…
• CVE-2018-6378In Joomla! Core before 3.8.8, inadequate filtering of file a…
• CVE-2018-6379In Joomla! before 3.8.4, inadequate input filtering in the U…
• CVE-2018-6380In Joomla! before 3.8.4, lack of escaping in the module chro…
• CVE-2018-6382MantisBT 2.10.0 allows local users to conduct SQL Injection …
• CVE-2018-6383Monstra CMS through 3.0.4 has an incomplete "forbidden types…8.8
• CVE-2018-6384Unquoted Windows search path vulnerability in NSClient++ bef…
• CVE-2018-6387iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have …
• CVE-2018-6388iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow…
• CVE-2018-6389In WordPress through 4.9.2, unauthenticated attackers can ca…