Red Hat Security Advisory

RHSA-2015:0700

unzip security update

Released 2015-03-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) unzip-6.0-15.el7
Red Hat Enterprise Linux ComputeNode (v. 7) unzip-6.0-15.el7
Red Hat Enterprise Linux Desktop (v. 6) unzip-6.0-2.el6_6
Red Hat Enterprise Linux HPC Node (v. 6) unzip-6.0-2.el6_6
Red Hat Enterprise Linux Server (v. 6) unzip-6.0-2.el6_6
Red Hat Enterprise Linux Server (v. 7) unzip-6.0-15.ael7b, unzip-6.0-15.el7
Red Hat Enterprise Linux Workstation (v. 6) unzip-6.0-2.el6_6
Red Hat Enterprise Linux Workstation (v. 7) unzip-6.0-15.el7

Fixes 4 records

TI-2014-06756 CVE-2014-8141 · GHSA-3gfx-c6cm-vch8

Out-of-bounds write in Info-ZIP UnZip

MEDIUM 44

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.07448 Published 2020-01-31 Fixed CWE-787

TI-2014-06755 CVE-2014-8140 · GHSA-fhf3-rjhh-4c23

Out-of-bounds write in Info-ZIP UnZip

MEDIUM 44

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.07448 Published 2020-01-31 Partial fix CWE-787

TI-2014-06754 CVE-2014-8139 · GHSA-fhcq-p46p-2xvm

Out-of-bounds write in Info-ZIP UnZip

MEDIUM 44

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.07448 Published 2020-01-31 Partial fix CWE-787

TI-2014-07826 CVE-2014-9636 · GHSA-9gph-v8wv-c92v

unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or…

LOW 37

unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.11874 Published 2015-02-06 Partial fix CWE-119