Stay Secure with the Latest Linux Advisories

security advisorymoderatecode execution

Mageia 8: 2022-0371 Moderate: Unzip Null Pointer Dereference

Improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2021-4217) Conversion of a wide string to a local string that leads to a heap of . MGASA-2022-0371 - Updated unzip packages fix security vulnerability Publication date: 18 Oct 2022 URL: https://advisories.mageia.org/MGASA-2022-0371.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-4217, CVE-2022-0529, CVE-2022-0530 Improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2021-4217) Conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. (CVE-2022-0529, CVE-2022-0530) References: - https://bugs.mageia.org/show_bug.cgi?id=29893 - https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077 - https://bugzilla.redhat.com/show_bug.cgi?id=2044583 - https://bugzilla.redhat.com/show_bug.cgi?id=2051395 - https://bugzilla.redhat.com/show_bug.cgi?id=2051402 - https://lists.debian.org/debian-security-announce/2022/msg00171.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html - - https://ubuntu.com/security/notices/USN-5673-1 - https://www.cve.org/CVERecord?id=CVE-2021-4217 - https://www.cve.org/CVERecord?id=CVE-2022-0529 - https://www.cve.org/CVERecord?id=CVE-2022-0530 SRPMS: - 8/core/unzip-6.0-2.1.mga8 . Security notification for Mageia 8 regarding vulnerabilities in zip file handling leading to system crashes and risk of arbitrary code execution. Further information enclosed.. unzip security update,Mageia advisory,Unicode handling issue,code execution vulnerability. . LinuxSecurity.com Team

Oct 18, 2022 Mageia