Every CVE Search/ Get API key

CVE-2019-13232

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial...

3.3 LowFix available

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.50%Down 1.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
CVE-2019-13232
Updated
2026-11-02
EUVDEUVD-2019-4743 No score

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
EUVD-2019-4743
Updated
2026-11-03
GitHub AdvisoriesGHSA-8vm7-647w-p9g4 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial...

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
GHSA-8vm7-647w-p9g4
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2019-13232 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
ALPINE-CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-35341 3.3

CVE-2019-13232 affecting package unzip for versions less than 6.0-20

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
AZL-35341
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 10 moreShow less
OSVAZL-6943 3.3

CVE-2019-13232 affecting package unzip for versions less than 6.0-19

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
AZL-6943
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2019-13232 3.3

CVE-2019-13232 does not affect BellSoft software

Record
BELL-CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2019-13232 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
DEBIAN-CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2020:1181 4.0

Red Hat Security Advisory: unzip security update

Record
RHSA-2020:1181
CVSS 3.0
4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2020:1787 4.0

Red Hat Security Advisory: unzip security update

Record
RHSA-2020:1787
CVSS 3.0
4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2020:2486 4.0

Red Hat Security Advisory: unzip security update

Record
RHSA-2020:2486
CVSS 3.0
4.0 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-13232 3.3

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

Record
UBUNTU-CVE-2019-13232
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0033 No score

Updated unzip package fixes a security vulnerability

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue (CVE-2019-13232).

Record
MGASA-2021-0033
Updated
2026-11-02
OSVUSN-4672-1 No score

unzip vulnerabilities

Rene Freingruber discovered that unzip incorrectly handled certain specially crafted password protected ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker could exploit this to cause a crash, resulting in a denial of service. (CVE-2018-1000035)

Antonio Carista discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. (CVE-2018-18384)

It was discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker could exploit this to cause resource consumption, resulting in a denial of service. (CVE-2019-13232)

Martin Carpenter discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2014-9913)

Alexis Vanden Eijnde discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2016-9844)

Record
USN-4672-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unzip
Alpine:v3.10
 before 6.0-r6
6.0-r6
unzip
Alpine:v3.11
 before 6.0-r6
6.0-r6
unzip
Alpine:v3.12
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.13
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.14
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.15
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.16
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.17
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.18
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.19
 before 6.0-r7
6.0-r7
Show 32 moreShow less
Affected packages
PackageAffectedFixed
unzip
Alpine:v3.20
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.21
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.22
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.23
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.24
 before 6.0-r7
6.0-r7
unzip
Alpine:v3.8
 before 6.0-r6
6.0-r6
unzip
Alpine:v3.9
 before 6.0-r6
6.0-r6
unzip
Azure Linux:3
 before 6.0-20
6.0-20
unzip
Azure Linux:2
 before 6.0-19
6.0-19
unzip
Debian:12
 before 6.0-24
6.0-24
unzip
Debian:13
 before 6.0-24
6.0-24
unzip
Debian:14
 before 6.0-24
6.0-24
unzip
Debian:8
 before 6.0-16+deb8u4, plus listed versions
6.0-166.0-16+deb8u16.0-16+deb8u26.0-16+deb8u3
6.0-16+deb8u4
unzip
Mageia:7
 before 6.0-1.mga7
6.0-1.mga7
unzip
Red Hat:enterprise_linux:7::client
 before 0:6.0-21.el7
0:6.0-21.el7
unzip-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:6.0-21.el7
0:6.0-21.el7
unzip
Red Hat:enterprise_linux:7::computenode
 before 0:6.0-21.el7
0:6.0-21.el7
unzip-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:6.0-21.el7
0:6.0-21.el7
unzip
Red Hat:enterprise_linux:7::server
 before 0:6.0-21.el7
0:6.0-21.el7
unzip-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:6.0-21.el7
0:6.0-21.el7
unzip
Red Hat:enterprise_linux:7::workstation
 before 0:6.0-21.el7
0:6.0-21.el7
unzip-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:6.0-21.el7
0:6.0-21.el7
unzip
Red Hat:enterprise_linux:8::baseos
 before 0:6.0-43.el8
0:6.0-43.el8
unzip-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:6.0-43.el8
0:6.0-43.el8
unzip-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:6.0-43.el8
0:6.0-43.el8
unzip
Red Hat:rhel_eus:7.7::computenode
 before 0:6.0-20.el7_7.1
0:6.0-20.el7_7.1
unzip-debuginfo
Red Hat:rhel_eus:7.7::computenode
 before 0:6.0-20.el7_7.1
0:6.0-20.el7_7.1
unzip
Red Hat:rhel_eus:7.7::server
 before 0:6.0-20.el7_7.1
0:6.0-20.el7_7.1
unzip-debuginfo
Red Hat:rhel_eus:7.7::server
 before 0:6.0-20.el7_7.1
0:6.0-20.el7_7.1
unzip
Ubuntu:Pro:14.04:LTS
 before 6.0-9ubuntu1.6, plus listed versions
6.0-9ubuntu16.0-9ubuntu1.16.0-9ubuntu1.26.0-9ubuntu1.36.0-9ubuntu1.46.0-9ubuntu1.5
6.0-9ubuntu1.6
unzip
Ubuntu:16.04:LTS
 before 6.0-20ubuntu1.1, plus listed versions
6.0-17ubuntu16.0-19ubuntu16.0-19ubuntu26.0-20ubuntu1
6.0-20ubuntu1.1
unzip
Ubuntu:18.04:LTS
 before 6.0-21ubuntu1.1, plus listed versions
6.0-21ubuntu1
6.0-21ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13232 is a low vulnerability (CVSS 3.3) in Unzip Project Unzip, published July 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in unzip 6.0-r6.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open