Skip to content
OpenAdvisories
Low ALAS2-2023-1906 3 CVEs

Low: unzip security update (Amazon Linux 2)

Published Jan 18, 2023 · Updated Jan 20, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0530: A flaw was found in Unzip. The vulnerability occurs during the conversion of a UTF-8 string to a local string that leads to a segmentation fault. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2022-0529: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2021-4217: A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 unzip 0:6.0-57.amzn2.0.1
Amazon Linux · 2 unzip-debuginfo 0:6.0-57.amzn2.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-4217.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-0529.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-0530.html