CVE-2008-0888 affecting package unzip 6.0-19

CVE-2008-0888 affecting package unzip 6.0-19. A patched version of the package is available...

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

...

Denial Of Service (DoS)

busybox is vulnerable to denial of service DoS. huftbuild in archival/libarchive/decompressgunzip.c in BusyBox misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file...

CVE-2016-9844 affecting package unzip 6.0-19

CVE-2016-9844 affecting package unzip 6.0-19. A patched version of the package is available...

CVE-2014-9913 affecting package unzip 6.0-19

CVE-2014-9913 affecting package unzip 6.0-19. A patched version of the package is available...

CVE-2018-18384 affecting package unzip 6.0-19

CVE-2018-18384 affecting package unzip 6.0-19. A patched version of the package is available...

CVE-2015-7697 affecting package unzip 6.0-19

CVE-2015-7697 affecting package unzip 6.0-19. A patched version of the package is available...

CVE-2015-7696 affecting package unzip 6.0-19

CVE-2015-7696 affecting package unzip 6.0-19. A patched version of the package is available...

Command Injection in cocos-utils

All versions of cocos-utils are vulnerable to Remote Code Execution. The unzip function concatenates user input to exec which may allow attackers to execute arbitrary commands on the server. Recommendation No fix is currently available. Consider using an alternative module until a fix is made...

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

...

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

...

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

...

Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.

...

Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.

...

Info-ZIP UnZip 6.0 has a buffer overflow in list.c when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value because a buffer size is 10 and is supposed to be 12.

...

A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.

...

Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.

...

Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive possibly related to an Extra-Field size value.

...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2019-13232)

Summary IBM MQ Appliance has addressed the following denial of service vulnerability. Vulnerability Details CVEID: CVE-2019-13232 DESCRIPTION: Info-ZIP UnZip is vulnerable to a denial of service, caused by mishandling the overlapping of files inside a ZIP container. By persuading a victim to open...

SUSE SLES12 Security Update : unzip (SUSE-SU-2020:1796-1)

This update for unzip fixes the following issues : CVE-2018-18384: Fixed a buffer overflow when listing files bsc1110194 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and form...