Unzip - Buffer Overflow Vulnerability
Summary
DLA-741-1: unzip - security update. Affects unzip versions < 6.0-8+deb7u6. Fixed in 6.0-8+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unzip is a utility program used for extracting files from ZIP archives. It is commonly used to compress and decompress files on Debian 7 Wheezy systems. However, versions prior to 6.0-8+deb7u6 are vulnerable to buffer overflow attacks when processing malformed or malicious ZIP files.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9913 and CVE-2016-9844, allows an attacker to exploit buffer overflows in the 'unzip -l' and 'zipinfo' commands. By providing specially crafted ZIP files, an attacker can trigger these buffer overflows, potentially leading to arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
6.0-8+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible to mitigate the risk.
Conclusion
The 'unzip' package on Debian 7 Wheezy is vulnerable to buffer overflow attacks when processing malformed or malicious ZIP files. To mitigate this vulnerability, it is crucial to upgrade to version 6.0-8+deb7u6 or later. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for unzip →
FAQ
This vulnerability allows an attacker to execute arbitrary code or cause a denial of service on systems running vulnerable versions of 'unzip'. It is important to patch the software to prevent potential exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
Yes, this vulnerability can be exploited remotely if an attacker can trick a user into opening a malicious ZIP file or if the ZIP file is automatically processed by a vulnerable system.
There have been no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the security update to protect against potential future attacks.
You can find more information about this vulnerability, including the CVE identifiers, in the Debian LTS security advisory: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for unzip.
