CVE-2006-0950

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with "....

2.6 LowFix available

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Exploit likelihood

1.71%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 2.6

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: CVE-2006-0950
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: CVE-2006-0950
Updated: 2026-11-02

EUVDEUVD-2006-0953 No score

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: EUVD-2006-0953
Updated: 2026-11-03

GitHub AdvisoriesGHSA-54g6-7vx7-p9jx No score

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with "....

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: GHSA-54g6-7vx7-p9jx
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: CVE-2006-0950
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-0950 No score

unalz 0.53 allows user-assisted attackers to overwrite arbitrary files via an ALZ archive with ".." (dot dot) sequences in a filename.

Record: DEBIAN-CVE-2006-0950
Updated: 2026-11-02

Affected products

unalz

Affected packages

Affected packages
Package	Affected	Fixed
`unalz` Debian:12	before 0.55-1	0.55-1
`unalz` Debian:13	before 0.55-1	0.55-1
`unalz` Debian:14	before 0.55-1	0.55-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-0950 is a low vulnerability (CVSS 2.6) in Unalz, published March 13, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in unalz 0.55-1.

References

Show 7 moreShow less