A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-unzip | Mar 26, 2024 | Feb 9, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-unzipamazon-linux-ami-2-upgrade-unzip-debuginfo | Jan 24, 2023 | Feb 9, 2022 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-unzipamazon-linux-2023-upgrade-unzip-debuginfoamazon-linux-2023-upgrade-unzip-debugsource | Feb 17, 2025 | Jan 24, 2022 | |
| Debian | debian-upgrade-unzip | Sep 26, 2022 | Feb 9, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-app-arch-unzip | Oct 31, 2023 | Feb 9, 2022 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-unzip | May 9, 2022 | Feb 9, 2022 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-unzip | May 25, 2022 | Feb 9, 2022 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-unzip | Jun 17, 2022 | Feb 9, 2022 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-unzip | Jun 16, 2022 | Feb 9, 2022 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Feb 9, 2022 |
| Suse | — | suse-upgrade-unzipsuse-upgrade-unzip-doc | Oct 26, 2022 | Feb 9, 2022 |
| Ubuntu | ubuntu-pro-upgrade-unzipubuntu-upgrade-unzip | Oct 13, 2022 | Feb 9, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Feb 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub