PatchTheCVEunzip vulnerabilities and fixes
Recent CVEs affecting unzip, with upgrade or downgrade steps. 14 tracked.
unzip has 14 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 6. Most recent: 2022-12-27. Highest priority: CVE-2020-36561 (score 60/100).
- CVE-2022-0530 MEDIUM 5.5 DOWNGRADE MITIGATE A flaw was found in Unzip
- CVE-2022-0529 MEDIUM 5.5 DOWNGRADE MITIGATE A flaw was found in Unzip
- CVE-2021-4217 LOW 3.3 DOWNGRADE MITIGATE A flaw was found in unzip
- CVE-2020-36561 CRITICAL 9.1 UPGRADE Due to improper path sanitization, archives containing relative file paths can cause files to be written (or o
- CVE-2019-13232 LOW 3.3 DOWNGRADE MITIGATE Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (r
- CVE-2018-18384 MEDIUM 5.5 DOWNGRADE Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the
- CVE-2018-1000035 HIGH 7.8 UPGRADE A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected
- CVE-2018-1000034 CRITICAL 9.1 DOWNGRADE An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of
- CVE-2018-1000033 CRITICAL 9.1 DOWNGRADE An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of
- CVE-2018-1000032 HIGH 7.8 DOWNGRADE A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a den
- CVE-2018-1000031 HIGH 7.8 DOWNGRADE A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a den
- CVE-2014-8141 HIGH 7.8 UPGRADE MITIGATE Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attack
- CVE-2014-8140 HIGH 7.8 UPGRADE MITIGATE Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attac
- CVE-2014-8139 HIGH 7.8 UPGRADE MITIGATE Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers
FAQ
How do I fix unzip vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is unzip being exploited right now?
None of the tracked unzip CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which unzip CVE should I patch first?
CVE-2020-36561 currently ranks highest (60/100): Due to improper path sanitization, archives containing relative file paths can cause files to be written (or o.