Unzipproject Unzip
By the Year
In 2024 there have been 0 vulnerabilities in Unzipproject Unzip . Unzip did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 4 | 5.85 |
| 2021 | 0 | 0.00 |
| 2020 | 3 | 7.80 |
| 2019 | 1 | 3.30 |
| 2018 | 2 | 6.65 |
It may take a day or so for new Unzip vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Unzipproject Unzip Security Vulnerabilities
Due to improper path sanitization, archives containing relative file paths
CVE-2020-36561
9.1 - Critical
- December 27, 2022
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Directory traversal
A flaw was found in unzip
CVE-2021-4217
3.3 - Low
- August 24, 2022
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
NULL Pointer Dereference
A flaw was found in Unzip
CVE-2022-0530
5.5 - Medium
- February 09, 2022
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
A flaw was found in Unzip
CVE-2022-0529
5.5 - Medium
- February 09, 2022
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Memory Corruption
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier
CVE-2014-8141
7.8 - High
- January 31, 2020
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Memory Corruption
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier
CVE-2014-8140
7.8 - High
- January 31, 2020
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Memory Corruption
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier
CVE-2014-8139
7.8 - High
- January 31, 2020
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Memory Corruption
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container
CVE-2019-13232
3.3 - Low
- July 04, 2019
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
Resource Exhaustion
Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value
CVE-2018-18384
5.5 - Medium
- October 16, 2018
Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.
Buffer Overflow
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives
CVE-2018-1000035
7.8 - High
- February 09, 2018
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Unzipproject Unzip or by Unzipproject? Click the Watch button to subscribe.
