Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0530: A flaw was found in Unzip. The vulnerability occurs during the conversion of a UTF-8 string to a local string that leads to a segmentation fault. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2022-0529: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2021-4217: A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | unzip | 0:6.0-57.amzn2.0.1 |
| Amazon Linux · 2 | unzip-debuginfo | 0:6.0-57.amzn2.0.1 |
Vulnerabilities 3
-
Unscored —
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a nu…
-
Unscored —CVE-2022-0529 Public exploit
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…