Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2021-4217

unzip: Null pointer dereference in Unicode strings code

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Unzip Project
Products
Fedora Enterprise Linux Unzip
CVE-2022-0530

unzip: SIGSEGV during the conversion of an utf-8 string to a local string

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Mac Os X Macos Debian Linux and 3 more
CVE-2022-0529

unzip: Heap out-of-bound writes and reads during conversion of wide string to local string

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

CVSS 3.1 · 5.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2008-0888

unzip: free() called for uninitialized or already freed pointer

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

CVSS 2.0 · 9.3 Critical EPSS 6.3% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Mac Os X Ubuntu Linux Debian Linux and 2 more
CVE-2014-9913

unzip: methbuf[] buffer overflow in unzip's list_files()

Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.

CVSS 3.0 · 4.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Unzip Project
Products
Unzip
CVE-2016-9844

unzip: methbuf[] buffer overflow in zipinfo's zi_short()

Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.

CVSS 3.0 · 4.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Unzip Project
Products
Unzip
CVE-2015-7696

unzip: Heap overflow and DoS in 6.0

Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.

CVSS 2.0 · 6.8 Medium EPSS 7.2% KEV · Not listed
Vendors
Canonical Debian Unzip Project
Products
Ubuntu Linux Debian Linux Unzip
CVE-2014-9636

unzip: out-of-bounds read/write in test_compr_eb() in extract.c

unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.

CVSS 2.0 · 5.0 Medium EPSS 11.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2020-36561

Path traversal in github.com/yi-ge/unzip

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed
Vendors
Unzip Project
Products
Unzip
CVE-2018-18384

unzip: Buffer overflow in list.c resulting in a denial of service

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat Unzip Project
Products
Enterprise Linux Unzip
CVE-2018-1000035

unzip: Heap-based buffer overflow in fileio.c:UzpPassword function allows code execution

A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.

CVSS 3.0 · 7.8 High EPSS 30.1% KEV · Not listed
Vendors
Unzip Project
Products
Unzip