Unscored CVE-2015-1315 EUVD-2015-1456GHSA-2xg4-jx3q-qjrp

Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code …

Published Feb 23, 2015 · Updated Aug 6, 2024 · Assigned by canonical

Description

Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 14.04 LTS	unzip	6.0-9ubuntu1.3	USN-2502-1

Advisories 1

USN-2502-1 unzip vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026

References

https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/580961/comments/120
http://www.conostix.com/pub/adv/CVE-2015-1315-Info-ZIP-unzip-Out-of-bounds_Write.txt
[oss-security] 20150217 CVE-2015-1315 - Info-ZIP UnZip - Out-of-bounds Write mailing-list
USN-2502-1 vendor-advisory