Published: 16/03/2018 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache commons compress
oracle weblogic server 14.1.1.0.0
oracle mysql cluster

Debian Bug report logs - #893174 libcommons-compress-java: CVE-2018-1324: Infinite loop via extra field parser in ZipFile and ZipArchiveInputStream classes Package: src:libcommons-compress-java; Maintainer for src:libcommons-compress-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: ...

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 111 to 115 This can be used to mount a denial of service attack against services that use Compress' zip package ...

APR4Vul: an empirical study of automatic program repair techniques on real-world Java vulnerabilities

APR4Vul Abstract: Security vulnerability fixes could be a promising research avenue for Automated Program Repair (APR) techniques In recent years, APR tools have been thoroughly developed for fixing generic bugs However, the area is still relatively unexplored when it comes to fixing security bugs or vulnerabilities In this paper, we evaluate nine state-of-the-art APR tools

CWE-835 http://www.securitytracker.com/id/1040549 http://www.securityfocus.com/bid/103490 https://www.oracle.com/security-alerts/cpujan2022.html https://lists.apache.org/thread.html/1c7b6df6d1c5c8583518a0afa017782924918e4d6acfaf23ed5b2089%40%3Cdev.commons.apache.org%3E https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E https://lists.apache.org/thread.html/r5532dc8d5456b5151e8c286801e2e5769f5c04118b29c3b5d13ea387%40%3Cissues.beam.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893174 https://nvd.nist.gov https://github.com/tuhh-softsec/APR4Vul https://access.redhat.com/security/cve/cve-2018-1324

CVE-2018-1324

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect