CVE-2022-0530
Fixed in a distro release EPSS 2%
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Products: unzip_project unzip, redhat enterprise_linux, fedoraproject fedora, apple mac_os_x, apple macos, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.17 | unzip | 6.0-r11 |
| Alpine 3.18 | unzip | 6.0-r11 |
| Alpine 3.19 | unzip | 6.0-r11 |
| Alpine 3.20 | unzip | 6.0-r11 |
| Alpine 3.21 | unzip | 6.0-r11 |
| Alpine 3.22 | unzip | 6.0-r11 |
| Alpine 3.23 | unzip | 6.0-r11 |
| Alpine 3.24 | unzip | 6.0-r11 |
| Amazon Linux 2 | unzip | 6.0-57.amzn2.0.1 |
| Amazon Linux 2023 | unzip | 6.0-57.amzn2023.0.2 |
| Debian 10 | unzip | 6.0-23+deb10u3 |
| Debian 11 | unzip | 6.0-26+deb11u1 |
| Debian 12 | unzip | 6.0-27 |
| Debian 13 | unzip | 6.0-27 |
| Debian 14 | unzip | 6.0-27 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | unzip | 6.00-150000.4.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | unzip | 6.00-150000.4.11.1 |
| SUSE Linux Enterprise Server 12 SP5 | unzip | 6.00-33.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | unzip | 6.00-33.16.1 |
| Ubuntu 18.04 LTS | unzip | 6.0-21ubuntu1.2 |
| Ubuntu 20.04 LTS | unzip | 6.0-25ubuntu1.1 |
| Ubuntu 22.04 LTS | unzip | 6.0-26ubuntu3.1 |
| Ubuntu Pro 14.04 LTS | unzip | 6.0-9ubuntu1.6+esm1 |
| Ubuntu Pro 16.04 LTS | unzip | 6.0-20ubuntu1.1+esm1 |
| openSUSE Leap 15.3 | unzip | 6.00-150000.4.11.1 |
| openSUSE Leap 15.4 | unzip | 6.00-150000.4.11.1 |
| openSUSE Tumbleweed | unzip | 6.00-40.1 |