USN-5673-1: unzip vulnerabilities
13 October 2022
Several security issues were fixed in unzip.
Releases
Packages
- unzip - De-archiver for .zip files
Details
It was discovered that unzip did not properly handle unicode strings under
certain circumstances. If a user were tricked into opening a specially crafted
zip file, an attacker could possibly use this issue to cause unzip to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-4217)
It was discovered that unzip did not properly perform bounds checking while
converting wide strings to local strings. If a user were tricked into opening a
specially crafted zip file, an attacker could possibly use this issue to cause
unzip to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2022-0529, CVE-2022-0530)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
-
unzip
-
6.0-20ubuntu1.1+esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
unzip
-
6.0-9ubuntu1.6+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
Related notices
- USN-7054-1: unzip