USN-2788-2
unzip regression
USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code. (CVE-2015-7696)
Gustavo Grieco discovered that unzip incorrectly handled certain malformed archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly cause unzip to hang, resulting in a denial of service. (CVE-2015-7697)
What each source reports
OSV No score
unzip regression
USN-2788-1 fixed vulnerabilities in unzip. One of the security patches caused a regression when extracting 0-byte files. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Gustavo Grieco discovered that unzip incorrectly handled certain password protected archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code. (CVE-2015-7696)
Gustavo Grieco discovered that unzip incorrectly handled certain malformed archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly cause unzip to hang, resulting in a denial of service. (CVE-2015-7697)
- Record
USN-2788-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unzipUbuntu:14.04:LTS |
before 6.0-9ubuntu1.5, plus listed versions 6.0-9ubuntu16.0-9ubuntu1.16.0-9ubuntu1.26.0-9ubuntu1.36.0-9ubuntu1.4 |
6.0-9ubuntu1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-2788-2 is a vulnerability with no CVSS score yet in unzip, published November 9, 2015. No source lists public exploit code. Fixed in unzip 6.0-9ubuntu1.5.