PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5974 Gdraheim CVE debrief

CVE-2017-5974 is a heap-based buffer overflow in zziplib's __zzip_get32 function in fetch.c. A crafted ZIP file can trigger a crash, making this primarily an availability issue for software that parses untrusted archives. NVD maps the flaw to CWE-119 and assigns CVSS 5.5 (Medium).

Vendor
Gdraheim
Product
Zziplib
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Developers and administrators using zziplib, especially applications that open user-supplied ZIP archives or package deployments on Debian systems listed in the NVD record (Debian 8.0 and 9.0).

Technical summary

The NVD record lists zziplib versions 0.13.56 through 0.13.62 as vulnerable. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating denial-of-service impact with user interaction required. The CVE description says the trigger is a crafted ZIP file, and the weakness is classified as CWE-119 (memory corruption / improper restriction of operations within the bounds of a memory buffer).

Defensive priority

Medium — prioritize remediation on systems that process untrusted ZIP files or where archive parsing is exposed to end users.

Recommended defensive actions

  • Update zziplib to a version outside the vulnerable range 0.13.56 through 0.13.62 using your distribution or vendor guidance.
  • Review and apply the relevant vendor/distribution advisory, including Debian DSA-3878 if you rely on Debian packages.
  • Reduce exposure to untrusted ZIP content until patched by restricting archive ingestion and sandboxing archive-processing services.
  • Monitor affected applications for unexpected crashes or restarts that could indicate successful triggering of the overflow.

Evidence notes

This debrief is based only on the supplied CVE/NVD corpus and linked references. The record states the affected zziplib versions (0.13.56-0.13.62), the weakness type (CWE-119), the CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), and the availability-only impact. NVD metadata also lists related references for Debian DSA-3878, an oss-security mailing list post, SecurityFocus BID 96268, and a Gentoo advisory entry. The corpus does not include the full text of those references, so fix-version details are intentionally kept general.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5974 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5974

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5974 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5974

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.