http://sourceforge.net/p/infozip/patches/23/

DSA-3386

[oss-security] 20150907 Heap overflow and DoS in unzip 6.0

[oss-security] 20150915 Re: Heap overflow and DoS in unzip 6.0

[oss-security] 20151011 Re: Heap overflow and DoS in unzip 6.0

76863

1034027

USN-2788-1

USN-2788-2

According to the versions of the unzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 mishandles the overlapping of files     inside a ZIP container, leading to denial of service     (resource consumption), aka a 'better zip bomb'     issue.(CVE-2019-13232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Buffer overflow in the list_files function in list.c in     Info-Zip UnZip 6.0 allows remote attackers to cause a     denial of service (crash) via vectors related to the     compression method.(CVE-2014-9913)

  - Buffer overflow in the zi_short function in zipinfo.c     in Info-Zip UnZip 6.0 allows remote attackers to cause     a denial of service (crash) via a large compression     method value in the central directory file     header.(CVE-2016-9844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the unzip package has been released.

This update for unzip fixes the following security issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074).

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442).

This non-security issue was fixed :

  - Allow processing of Windows zip64 archives (Windows     archivers set total_disks field to 0 but per standard,     valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-12:Update update project.

This update for unzip fixes the following security issues :

CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993)

CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110)

CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111)

CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992)

CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074).

CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [ subversion, libtasn1, unzip, dhcp ] packages for PhotonOS has been released.

This update for unzip fixes the following issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unzip fixes the following issues :

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

Gustavo Grieco reports :

Two issues were found in unzip 6.0 :

* A heap overflow triggered by unzipping a file with password (e.g unzip -p -P x sigsegv.zip).

* A denegation of service with a file that never finishes unzipping (e.g. unzip sigxcpu.zip).

USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem.

We apologize for the inconvenience.

Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code. (CVE-2015-7696)

Gustavo Grieco discovered that unzip incorrectly handled certain malformed archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly cause unzip to hang, resulting in a denial of service. (CVE-2015-7697).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been found in unzip, a de-archiver for .zip files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-7696     Gustavo Grieco discovered that unzip incorrectly handled     certain password protected archives. If a user or     automated system were tricked into processing a     specially crafted zip archive, an attacker could     possibly execute arbitrary code.

  - CVE-2015-7697     Gustavo Grieco discovered that unzip incorrectly handled     certain malformed archives. If a user or automated     system were tricked into processing a specially crafted     zip archive, an attacker could possibly cause unzip to     hang, resulting in a denial of service.

Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code. (CVE-2015-7696)

Gustavo Grieco discovered that unzip incorrectly handled certain malformed archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly cause unzip to hang, resulting in a denial of service. (CVE-2015-7697).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gustavo Grieco discovered with a fuzzer that unzip was vulnerable to a heap overflow and to a denial of service with specially crafted password-protected ZIP archives.

For the Debian 6 squeeze, these issues haven been fixed in unzip 6.0-4+deb6u3.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135624	EulerOS Virtualization 3.0.2.2 : unzip (EulerOS-SA-2020-1462)	Nessus	Huawei Local Security Checks	medium
134511	EulerOS Virtualization for ARM 64 3.0.2.0 : unzip (EulerOS-SA-2020-1222)	Nessus	Huawei Local Security Checks	medium
132212	EulerOS 2.0 SP3 : unzip (EulerOS-SA-2019-2677)	Nessus	Huawei Local Security Checks	medium
131583	EulerOS 2.0 SP2 : unzip (EulerOS-SA-2019-2429)	Nessus	Huawei Local Security Checks	medium
130696	EulerOS 2.0 SP5 : unzip (EulerOS-SA-2019-2234)	Nessus	Huawei Local Security Checks	medium
121657	Photon OS 1.0: Unzip PHSA-2016-0013	Nessus	PhotonOS Local Security Checks	medium
117981	openSUSE Security Update : unzip (openSUSE-2018-1124)	Nessus	SuSE Local Security Checks	medium
117902	SUSE SLED12 / SLES12 Security Update : unzip (SUSE-SU-2018:2978-1)	Nessus	SuSE Local Security Checks	medium
111847	Photon OS 1.0: Dhcp / Libtasn1 / Subversion / Unzip PHSA-2016-0013 (deprecated)	Nessus	PhotonOS Local Security Checks	high
97654	SUSE SLES11 Security Update : unzip (SUSE-SU-2017:0639-1)	Nessus	SuSE Local Security Checks	medium
94063	openSUSE Security Update : unzip (openSUSE-2016-1188)	Nessus	SuSE Local Security Checks	medium
87747	FreeBSD : unzip -- multiple vulnerabilities (86c3c66e-b2f5-11e5-863a-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	medium
86809	Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : unzip regression (USN-2788-2)	Nessus	Ubuntu Local Security Checks	medium
86680	Debian DSA-3386-1 : unzip - security update	Nessus	Debian Local Security Checks	medium
86672	Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : unzip vulnerabilities (USN-2788-1)	Nessus	Ubuntu Local Security Checks	medium
86551	Debian DLA-330-1 : unzip security update	Nessus	Debian Local Security Checks	medium

CVE-2015-7697

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins