CVE-2022-0530

CVE-2022-0530 affects the unzip utility. Affected component: unzip (wide-string to local-string conversion) can cause a heap out-of-bounds write, leading to crash or potential code execution when processing crafted zip files. Public details show multiple vendors reporting the issue with similar d...

CVE-2022-0529

CVE-2022-0529 affects unzip. The flaw is a vulnerability in the handling of Unicode/wide strings during conversion to local strings, causing a heap out-of-bounds write when processing a crafted ZIP, leading to crash or potential code execution. Multiple connected advisories confirm this, with ven...

CVE-2019-13232

Info-ZIP UnZip 6.0 vulnerability CVE-2019-13232: overlapping file entries in a ZIP container can cause denial of service (resource consumption). Concrete details across connected docs show affected unzip versions (e.g., 6.0 and prior) and that multiple distributions released updates to mitigate b...

CVE-2014-8141

CVE-2014-8141 is a heap-based buffer overflow in the getZip64Data function of Info-ZIP UnZip 6.0 and earlier. Exploitation is via a crafted ZIP file passed to unzip with the -t option, enabling remote code execution as described by multiple advisories and CVE family references in connected docume...

CVE-2021-4217

CVE-2021-4217 affects unzip. The flaw stems from improper handling of Unicode strings, enabling a null pointer dereference that can crash or, per source documents, potentially allow code execution when processing specially crafted zip files. Connected advisories indicate patched unzip versions &g...

CVE-2014-8140

CVE-2014-8140 affects Info-ZIP UnZip 6.0 and earlier. The issue is a heap-based buffer overflow in the test_compr_eb function that can be triggered by a crafted ZIP file passed to unzip with the -t option, potentially allowing remote code execution. Several connected advisories confirm the same u...

CVE-2014-8139

CVE-2014-8139 is a vulnerability in Info-ZIP UnZip 6.0 and earlier, where a heap-based buffer overflow during CRC32 verification can be triggered by a crafted zip file, enabling code execution via unzip -t. Several Connected documents confirm this flaw is present in bundled/unzip implementations ...

CVE-2018-1000035

Info-Zip UnZip vulnerability CVE-2018-1000035 is a heap-based buffer overflow in UnZip

CVE-2018-18384

CVE-2018-18384 affects Info-ZIP UnZip 6.0. The vulnerability is a buffer overflow in list.c caused by a mismatch between a crafted compressed-size/uncompressed-size relationship and an insufficient buffer (size 10 instead of 12). For some distributions, patched packages exist (e.g., unzip 6.0-20 ...

CVE-2020-36561

CVE-2020-36561 is a path-traversal vulnerability in the unzip library used by github.com/yi-ge/unzip (go-unzip). The root cause is improper path sanitization that allows archives containing relative file paths to write or overwrite files outside the target directory. Documents indicate the issue ...

CVE-2014-9636

The CVE affects the unzip utility (core unzip code) with a vulnerability in test_compr_eb() where an extra field has an uncompressed size smaller than the compressed field size in a STORED- method ZIP entry, leading to an out-of-bounds read/write and possible denial of service or crash. Numerous ...

CVE-2015-7697

Info-ZIP UnZip 6.0 is affected by CVE-2015-7697: processing a ZIP archive containing empty bzip2 data can cause a denial of service via an infinite loop. The vulnerability is described across multiple connected sources (e.g., CBLMariner entries noting unzip

CVE-2015-7696

Info-ZIP UnZip 6.0 is vulnerable to a heap-based buffer over-read that can crash the application or possibly allow arbitrary code execution when processing crafted password-protected ZIP archives, possibly related to an Extra-Field size value. This CVE (CVE-2015-7696) is widely reported across di...

CVE-2014-9913

CVE-2014-9913 refers to a buffer overflow in Info-Zip UnZip 6.0’s list_files function (list.c) that can crash the application via ZIP compression-method-related inputs. Connected records indicate unzip packages in various distros with patches or newer versions (e.g., Mariner entries noting patche...

CVE-2008-0888

CVE-2008-0888 affects unzip. The NEEDBITS macro in inflate_dynamic (inflate.c) can be triggered with invalid buffers, leading to remote DoS (crash) and potentially arbitrary code execution via freeing uninitialized or previously-freed data. Connected advisories confirm unzip updates/patches exist...

CVE-2016-9844

CVE-2016-9844 affects Info-Zip UnZip 6.0, specifically the Zi_short function in zipinfo.c, where a buffer overflow can occur in the central directory header when a large compression method value is encountered, leading to a denial of service (crash). Multiple connected sources confirm the vulnera...