Heap-based Buffer Overflows in unzip
Summary
DSA-3113-1: unzip - security update. Affects unzip versions < 6.0-8+deb7u1. Fixed in 6.0-8+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unzip is an extraction utility for archives compressed in .zip format. It is commonly used to extract files from zip archives. The package is part of the Debian ecosystem and is specifically targeted at Debian 7 (wheezy).
Vulnerability Detail
The unzip package is affected by multiple heap-based buffer overflow vulnerabilities. These vulnerabilities exist within the CRC32 verification function, the test_compr_eb() function, and the getZip64Data() function. Exploiting these vulnerabilities could allow an attacker to execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
6.0-8+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
The unzip package is affected by multiple heap-based buffer overflow vulnerabilities. To mitigate these vulnerabilities, it is crucial to upgrade the unzip package to the fixed version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unzip →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code on the affected system.
The CRC32 verification function, the test_compr_eb() function, and the getZip64Data() function are affected.
The vulnerabilities affect versions prior to 6.0-8+deb7u1 for Debian 7 (wheezy).
The recommended mitigation is to upgrade the unzip package to the fixed version.
More information can be found in the Debian Security Advisory DSA-3113-1.
Related vulnerabilities
Recent vulnerabilities recorded for unzip.
