Secunia Research has discovered two vulnerabilities in ZipTV, which can be exploited by malicious people to compromise an application using the library.

1) A boundary error within the TZipTV component when listing files in ARJ archives can be exploited to cause a heap-based buffer overflow via a specially-crafted ARJ archive with an overly large ARJ header block.

Successful exploitation allows execution of arbitrary code when a malicious ARJ archive is listed.

2) A boundary error in UNACEV2.DLL (ztvunacev2.dll) when extracting ACE archives containing a file with an overly long filename can be exploited to cause a stack-based buffer overflow.

Successful exploitation allows execution of arbitrary code when a malicious ACE archive is extracted.

The vulnerabilities have been confirmed in the following versions.
* ZipTV for Delphi 7 version 2006.1.26.
* ZipTV for C++ Builder version 2006-1.16.

Other versions may also be affected.

Solution
Do not open untrusted archives.

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2006-50/

Deep Links
Links available to Secunia VIM customers