Multiple vulnerabilities have been discovered in UnZip, the worst of which could lead to code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/unzip | * | < 6.0_p27 | >= 6.0_p27 |
Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.
Multiple vulnerabilities have been discovered in UnZip. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All UnZip users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p27"
Multiple vulnerabilities have been found in UnZip, the worst of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/unzip | * | < 6.0_p25 | >= 6.0_p25 |
Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.
Multiple vulnerabilities have been discovered in UnZip. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted ZIP archive using UnZip, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All UnZip users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p25"
Multiple vulnerabilities have been found in UnZip allowing remote attackers to execute arbitrary code and cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/unzip | * | < 6.0_p20 | >= 6.0_p20 |
Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.
Multiple vulnerabilities were found in UnZip. Please review the referenced CVE’s for additional information.
Remote attackers could execute arbitrary code or cause Denial of Service.
There is no known workaround at this time.
All UnZip users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p20"
A double free vulnerability discovered in UnZip might lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/unzip | * | < 5.52-r2 | >= 5.52-r2 |
Info-ZIP's UnZip is a tool to list and extract files inside PKZIP compressed files.
Tavis Ormandy of the Google Security Team discovered that the NEEDBITS macro in the inflate_dynamic() function in the file inflate.c can be invoked using invalid buffers, which can lead to a double free.
Remote attackers could entice a user or automated system to open a specially crafted ZIP file that might lead to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All UnZip users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/unzip-5.52-r2"