Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.

An update of the unzip package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-
    protected archives that allows an attacker to perform a denial of service or to possibly achieve code
    execution. (CVE-2018-1000035)

  - Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote
    attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip
    command. (CVE-2014-8139)

  - Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote
    attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip
    command. (CVE-2014-8140)

  - Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote
    attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip
    command. (CVE-2014-8141)

  - unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via
    an extra field with an uncompressed size smaller than the compressed field size in a zip archive that
    advertises STORED method compression. (CVE-2014-9636)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to     cause a denial of service (crash) via vectors related to the compression method. (CVE-2014-9913)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of unzip installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2014-9913 advisory.

  - Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to     cause a denial of service (crash) via vectors related to the compression method. (CVE-2014-9913)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to
    cause a denial of service (crash) via vectors related to the compression method. (CVE-2014-9913)

  - Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between
    the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to
    be 12. (CVE-2018-18384)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4672-1 advisory.

    Rene Freingruber discovered that unzip incorrectly handled certain specially crafted password protected     ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip     file, an attacker could exploit this to cause a crash, resulting in a denial of service.
    (CVE-2018-1000035)

    Antonio Carista discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a     user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM and Ubuntu 14.04 ESM. (CVE-2018-18384)

    It was discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or     automated system using unzip were tricked into opening a specially crafted zip file, an attacker could     exploit this to cause resource consumption, resulting in a denial of service. (CVE-2019-13232)

    Martin Carpenter discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a     user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2014-9913)

    Alexis Vanden Eijnde discovered that unzip incorrectly handled certain specially crafted ZIP archives. If     a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2016-9844)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Buffer overflow in the list_files function in list.c in     Info-Zip UnZip 6.0 allows remote attackers to cause a     denial of service (crash) via vectors related to the     compression method.(CVE-2014-9913)

  - Buffer overflow in the zi_short function in zipinfo.c     in Info-Zip UnZip 6.0 allows remote attackers to cause     a denial of service (crash) via a large compression     method value in the central directory file     header.(CVE-2016-9844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unzip fixes the following security issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074).

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442).

This non-security issue was fixed :

  - Allow processing of Windows zip64 archives (Windows     archivers set total_disks field to 0 but per standard,     valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-12:Update update project.

This update for unzip fixes the following security issues :

CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993)

CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110)

CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111)

CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992)

CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074).

CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the list_files function in list.c in     Info-Zip UnZip 6.0 allows remote attackers to cause a     denial of service (crash) via vectors related to the     compression method.(CVE-2014-9913)

  - Buffer overflow in the zi_short function in zipinfo.c     in Info-Zip UnZip 6.0 allows remote attackers to cause     a denial of service (crash) via a large compression     method value in the central directory file     header.(CVE-2016-9844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unzip fixes the following issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'unzip -l' (CVE-2014-9913) and 'zipinfo' (CVE-2016-9844) were vulnerable to buffer overflows when provided malformed or maliciously-crafted ZIP files.

For Debian 7 'Wheezy', these problems have been fixed in version 6.0-8+deb7u6.

We recommend that you upgrade your unzip packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
333913	Photon OS 5.0: Unzip PHSA-2024-5.0-91-0424	Nessus	PhotonOS Local Security Checks	Local	medium
424590	Alpine: multiple unzip packages: security update to 6.0-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
424590	Alpine: multiple unzip packages: security update to 6.0-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
233762	Photon OS 5.0: Unzip PHSA-2024-5.0-0424	Nessus	PhotonOS Local Security Checks	Local	medium
218648	Linux Distros Unpatched Vulnerability : CVE-2014-9913	Nessus	Misc.	Local	medium
202833	Photon OS 1.0: Unzip PHSA-2017-0040	Nessus	PhotonOS Local Security Checks	Local	medium
201609	CBL Mariner 2.0 Security Update: unzip (CVE-2014-9913)	Nessus	MarinerOS Local Security Checks	Local	medium
400667	Alpine: multiple unzip packages: security update to 6.0-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400667	Alpine: multiple unzip packages: security update to 6.0-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400200	Alpine: multiple unzip packages: security update to 6.0-r8 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
400200	Alpine: multiple unzip packages: security update to 6.0-r8 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
144337	Ubuntu 16.04 LTS / 18.04 LTS : unzip vulnerabilities (USN-4672-1)	Nessus	Ubuntu Local Security Checks	Local	high
131583	EulerOS 2.0 SP2 : unzip (EulerOS-SA-2019-2429)	Nessus	Huawei Local Security Checks	Local	high
121930	Photon OS 2.0: Unzip PHSA-2018-2.0-0029	Nessus	PhotonOS Local Security Checks	Local	medium
117981	openSUSE Security Update : unzip (openSUSE-2018-1124)	Nessus	SuSE Local Security Checks	Local	high
117902	SUSE SLED12 / SLES12 Security Update : unzip (SUSE-SU-2018:2978-1)	Nessus	SuSE Local Security Checks	Local	high
110746	EulerOS 2.0 SP3 : unzip (EulerOS-SA-2018-1170)	Nessus	Huawei Local Security Checks	Local	medium
97654	SUSE SLES11 Security Update : unzip (SUSE-SU-2017:0639-1)	Nessus	SuSE Local Security Checks	Local	medium
95774	Debian DLA-741-1 : unzip security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-9913

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

high

high

medium

medium

high

high

medium

high

high

medium

medium

medium