Summary
It was discovered that unzip did not properly handle unicode strings under
certain circumstances. If a user were tricked into opening a specially crafted
zip file, an attacker could possibly use this issue to cause unzip to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-4217)
It was discovered that unzip did not properly perform bounds checking while
converting wide strings to local strings. If a user were tricked into opening a
specially crafted zip file, an attacker could possibly use this issue to cause
unzip to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2022-0529, CVE-2022-0530)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | unzip | 6.0-21ubuntu1.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | unzip | 6.0-25ubuntu1.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | unzip | 6.0-26ubuntu3.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | unzip | 6.0-9ubuntu1.6+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | unzip | 6.0-20ubuntu1.1+esm1 |
Vulnerabilities 3
-
Unscored —
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a nu…
-
Unscored —CVE-2022-0529 Public exploit
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…