Ubuntu 14.10 USN-2472-1 moderate: unzip Code Execution Threat

ubuntu

January 14, 2015

unzip could be made to crash or run programs if it opened a specially crafted file.

Summary

unzip could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- unzip: De-archiver for .zip files

Details:

Wolfgang Ettlinger discovered that unzip incorrectly handled certain

malformed zip archives. If a user or automated system were tricked into

processing a specially crafted zip archive, an attacker could possibly

execute arbitrary code.

Topics Covered

security advisory code execution malware threat unzip ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  unzip                           6.0-12ubuntu1.1

Ubuntu 14.04 LTS:
  unzip                           6.0-9ubuntu1.1

Ubuntu 12.04 LTS:
  unzip                           6.0-4ubuntu2.1

Ubuntu 10.04 LTS:
  unzip                           6.0-1ubuntu0.1

In general, a standard system update will make all the necessary changes.