Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Loading...
Explore Latest Linux Security advisories
We found 45 articles for you...
172
security advisorydenial of servicearbitrary code executionUbuntu 24.04 LTS USN-7054-1 critical: unzip denial of service
unzip could be made to crash or run programs as your login if it opened a specially crafted file.. ========================================================================== Ubuntu Security Notice USN-7054-1 October 03, 2024 unzip vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: unzip could be made to crash or run programs as your login if it opened a specially crafted file. Software Description: - unzip: De-archiver for .zip files Details: It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS unzip 6.0-28ubuntu4.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7054-1 CVE-2021-4217 Package Information: https://launchpad.net/ubuntu/+source/unzip/6.0-28ubuntu4.1 . Critical unzip vulnerability alert concerning Ubuntu's builds signals potential crashes and execution threats stemming from maliciously designed archives.. unzip security, Ubuntu advisory, denial of service issues, arbitrary code risks. . LinuxSecurity.com Team
Oct 03, 2024
Ubuntu
172
security advisorydenial of servicesecurity issueUbuntu 22.04 LTS USN-5674-1: Addressing Compression Flaws and Risks
Several security issues were fixed in unzip.. =========================================================================Ubuntu Security Notice USN-5673-1 October 13, 2022 unzip vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in unzip. Software Description: - unzip: De-archiver for .zip files Details: It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-4217) It was discovered that unzip did not properly perform bounds checking while converting wide strings to local strings. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-0529, CVE-2022-0530) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: unzip 6.0-26ubuntu3.1 Ubuntu 20.04 LTS: unzip 6.0-25ubuntu1.1 Ubuntu 18.04 LTS: unzip 6.0-21ubuntu1.2 Ubuntu 16.04 ESM: unzip 6.0-20ubuntu1.1+esm1 Ubuntu 14.04 ESM: unzip 6.0-9ubuntu1.6+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5673-1 CVE-2021-4217, CVE-2022-0529, CVE-2022-0530, Package Information: https://launchpad.net/ubuntu/+source/unzip/6.0-26ubuntu3.1 https://launchpad.net/ubuntu/+source/unzip/6.0-25ubuntu1.1 https://launchpad.net/ubuntu/+source/unzip/6.0-21ubuntu1.2 . Various unzip flaws addressed in Ubuntu LTS help guard against possible DoS and arbitrary code execution threats in compressed files.. unzip Vulnerabilities, Ubuntu Security, DoS Threats, Code Execution, Security Update. . LinuxSecurity.com Team
Oct 13, 2022
Ubuntu
100
security advisorymoderateheap corruptionSUSE: 2022:3399-1 Moderate: Fix for Unzip Heap Corruption Issue
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3399-1 Rating: moderate References: #1196177 #1196180 Cross-References: CVE-2022-0529 CVE-2022-0530 CVSS scores: CVE-2022-0529 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0529 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for unzip fixes the followingissues: - CVE-2022-0530: Fixed SIGSEGV during the conversion of an utf-8 string to a local string (bsc#1196177). - CVE-2022-0529: Fixed heap out-of-bound writes and reads during conversion of wide string to local string (bsc#1196180) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3399=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3399=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3399=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3399=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 unzip-doc-6.00-150000.4.11.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 unzip-doc-6.00-150000.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 References: https://www.suse.com/security/cve/CVE-2022-0529.html https://www.suse.com/security/cve/CVE-2022-0530.html https://bugzilla.suse.com/1196177 https://bugzilla.suse.com/1196180 . This enhancement corrects several significant problems in decompression utilities, reinforcing overallsystem reliability and safeguarding across various SUSE platforms.. unzip Update, SUSE Security, Moderate Threat Fix, Memory Safety. . LinuxSecurity.com Team
Sep 26, 2022
SuSE
100
security advisorysecurity updateunzipSUSE: 2022:3386-1 Moderate: Unzip Heap Out-Of-Bounds Fix
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3386-1 Rating: moderate References: #1196177 #1196180 Cross-References: CVE-2022-0529 CVE-2022-0530 CVSS scores: CVE-2022-0529 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0529 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for unzip fixes the following issues: - CVE-2022-0530: Fixed SIGSEGV during the conversion of an utf-8 string to a local string (bsc#1196177). - CVE-2022-0529: Fixed heap out-of-bound writes and reads during conversion of wide string to local string (bsc#1196180). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-3386=1 Package List: - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): unzip-6.00-33.16.1 unzip-debuginfo-6.00-33.16.1 unzip-debugsource-6.00-33.16.1 References: https://www.suse.com/security/cve/CVE-2022-0529.html https://www.suse.com/security/cve/CVE-2022-0530.html https://bugzilla.suse.com/1196177 https://bugzilla.suse.com/1196180 . SUSE issues a critical patch for unpacking tools tackling memoryoverflow vulnerabilities, encompassing several moderate severity CVE identifiers.. SUSE Security Update, Unzip Patches, Moderate CVEs, Security Fixes. . LinuxSecurity.com Team
Sep 26, 2022
SuSE
197
security advisorydenial of servicesecurity updateDebian LTS: DLA-3118-1 moderate: Unzip Denial Of Service
Sandipan Roy discovered two vulnerabilities in InfoZIP's unzip program, a de-archiver for .zip files, which could result in denial of service or potentially the execution of arbitrary code. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3118-1
Sep 22, 2022
Debian LTS
219
security advisorysecurity issuebug fixRocky Linux 8 RLBA-2021:2578 Unknown Severity Unzip Bug Fix
unzip bug fix and enhancement update. \{'type': 'BugFix', 'shortCode': 'RL', 'name': 'RLBA-2021:2578', 'synopsis': 'unzip bug fix and enhancement update', 'severity': 'UnknownSeverity', 'topic': 'An update for unzip is now available for Rocky Linux 8.', 'description': 'The unzip utility is used to list, test, and extract files from zip\narchives.\n(BZ#1970326)', 'solution': None, 'affectedProducts': ['Rocky Linux 8'], 'fixes': [], 'cves': ['Red Hat:::https://access.redhat.com/errata/RHBA-2021:2578:::RHBA-2021:2578'], 'references': [], 'publishedAt': '2021-07-22T18:22:24.048917Z', 'rpms': ['unzip-6.0-45.el8_4.aarch64.rpm', 'unzip-6.0-45.el8_4.src.rpm', 'unzip-6.0-45.el8_4.x86_64.rpm', 'unzip-debuginfo-6.0-45.el8_4.aarch64.rpm', 'unzip-debuginfo-6.0-45.el8_4.x86_64.rpm', 'unzip-debugsource-6.0-45.el8_4.aarch64.rpm', 'unzip-debugsource-6.0-45.el8_4.x86_64.rpm']}\. Recent bug in Unzip tool resolved in Rocky Linux 8 through the newest patch released to improve usability and protect against threats.. Rocky Linux Unzip Update,Bug Fix Rocky Linux,Security Advisory Rocky Linux. . LinuxSecurity.com Team
Sep 02, 2022
Rocky Linux
87
security advisorydenial of servicecode executionDebian: DSA-5202-1 Critical: Unzip Denial Of Service Update
Sandipan Roy discovered two vulnerabilities in InfoZIP's unzip program, a de-archiver for .zip files, which could result in denial of service or potentially the execution of arbitrary code. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5202-1
Aug 08, 2022
Debian
203
security advisorydenial of servicecriticalMageia 7 MGASA-2021-0033 Critical: Unzip DoS Resource Consumption
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue (CVE-2019-13232). References: . MGASA-2021-0033 - Updated unzip package fixes a security vulnerability Publication date: 17 Jan 2021 URL: https://advisories.mageia.org/MGASA-2021-0033.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-13232 Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue (CVE-2019-13232). References: - https://bugs.mageia.org/show_bug.cgi?id=25076 - https://access.redhat.com/errata/RHSA-2020:1787 - https://ubuntu.com/security/notices/USN-4672-1 - https://www.cve.org/CVERecord?id=CVE-2019-13232 SRPMS: - 7/core/unzip-6.0-1.mga7 . Revised extraction toolkit addresses vulnerabilities leading to service interruptions, impacting Mageia 7. Release date: 17 Jan 2021.. Mageia Security Update, Unzip Package Fix, DoS Attack Resolution. . LinuxSecurity.com Team
Jan 17, 2021
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!