CVE-2018-13410
** DISPUTED ** Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows...
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
CVE-2018-13410- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
CVE-2018-13410- Updated
- 2026-11-02
EUVDEUVD-2018-5353 No score
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
EUVD-2018-5353- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q826-v3v4-6jvj
** DISPUTED ** Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows...
** DISPUTED ** Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands.
- Record
GHSA-q826-v3v4-6jvj- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVAZL-35398
CVE-2018-13410 affecting package zip for versions less than 3.0-6
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
AZL-35398- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVAZL-7012
CVE-2018-13410 affecting package zip for versions less than 3.0-5
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
AZL-7012- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
CVE-2018-13410- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-13410
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
DEBIAN-CVE-2018-13410- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-13410
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands
- Record
UBUNTU-CVE-2018-13410- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0406 No score
Updated zip packages fix a security vulnerability
zip test option (-T) command injection. Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. (CVE-2018-13410)
- Record
MGASA-2026-0406- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zipAzure Linux:3 |
before 3.0-6 | 3.0-6 |
zipAzure Linux:2 |
before 3.0-5 | 3.0-5 |
zipDebian:12 |
before 3.0-13+deb12u1, plus listed versions 3.0-13 |
3.0-13+deb12u1 |
zipDebian:13 |
before 3.0-15 | 3.0-15 |
zipDebian:14 |
before 3.0-15 | 3.0-15 |
zipMageia:10 |
before 3.0-17.1.mga10 | 3.0-17.1.mga10 |
zipMageia:9 |
before 3.0-14.1.mga9 | 3.0-14.1.mga9 |
zipUbuntu:14.04:LTS |
All versions, plus listed versions 3.0-73.0-8 |
None known |
zipUbuntu:16.04:LTS |
All versions, plus listed versions 3.0-11 |
None known |
zipUbuntu:18.04:LTS |
All versions, plus listed versions 3.0-11build1 |
None known |
zipUbuntu:20.04:LTS |
All versions, plus listed versions 3.0-11build1 |
None known |
zipUbuntu:22.04:LTS |
All versions, plus listed versions 3.0-12build13.0-12build2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shinecome/zip | 2019-02-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-13410 is a critical vulnerability (CVSS 9.8) in Info-zip Project Zip, published July 6, 2018. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.77%, the 89th percentile. Fixed in zip 3.0-6.