{"id":"CVE-2016-9844","aliases":["ALPINE-CVE-2016-9844","AZL-35338","AZL-6940","BELL-CVE-2016-9844","DEBIAN-CVE-2016-9844","DLA-741-1","EUVD-2016-10644","GHSA-r3pw-cm89-hq37","MGASA-2017-0015","SUSE-SU-2017:0639-1","SUSE-SU-2018:2978-1","UBUNTU-CVE-2016-9844","USN-4672-1","openSUSE-SU-2024:11485-1"],"status":"published","title":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote...","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","severity":{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01835,"percentile":0.79057,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-12-13T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-19"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unzip","fixed_in":["6.0-21"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unzip","fixed_in":["6.0-21"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unzip","fixed_in":["6.0-21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"unzip","fixed_in":["6.0-20ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-8+deb7u6"}]}],"versions":["6.0-8","6.0-8+deb7u1","6.0-8+deb7u2","6.0-8+deb7u3","6.0-8+deb7u4","6.0-8+deb7u5"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-13.3.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.1"}]}],"versions":["6.0-21ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-39.1"}]}],"bundled":5}],"products":[{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"http://www.securityfocus.com/bid/94728","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/05/19","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/05/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/05/20","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9844","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r3pw-cm89-hq37"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9844","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9844","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9844","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0015.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19899","tags":["report"]},{"url":"https://lwn.net/Alerts/708934/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170639-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013992","tags":["report"]},{"url":"https://bugzilla.suse.com/1013993","tags":["report"]},{"url":"https://bugzilla.suse.com/950110","tags":["report"]},{"url":"https://bugzilla.suse.com/950111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9844","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182978-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080074","tags":["report"]},{"url":"https://bugzilla.suse.com/910683","tags":["report"]},{"url":"https://bugzilla.suse.com/914442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000035","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9844","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/12/05/20","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/12/05/25","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4672-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13232","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18384","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:00:00Z","modified":"2024-08-06T02:59:03.461Z","updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10644","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:00:00Z","modified":"2024-08-06T02:59:03Z","updated_at":"2026-11-03T02:22:26.376959Z"}],"ghsa":[{"id":"GHSA-r3pw-cm89-hq37","title":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote...","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2022-05-13T01:30:17Z","modified":"2023-02-01T05:08:12Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:42.317052Z"}],"nvd":[{"id":"CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01.373Z","modified":"2026-06-17T00:56:39.367Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"ALPINE-CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01.373Z","modified":"2026-09-22T06:17:50.255212125Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"AZL-35338","title":"CVE-2016-9844 affecting package unzip for versions less than 6.0-20","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6940","title":"CVE-2016-9844 affecting package unzip for versions less than 6.0-19","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01Z","modified":"2026-04-21T04:38:35.32477Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"BELL-CVE-2016-9844","title":"CVE-2016-9844 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:01.144353Z","modified":"2026-01-26T09:46:58.662283Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01.373Z","modified":"2026-04-16T06:19:21.272580876Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:01.373Z","modified":"2026-09-22T07:02:46.751939634Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9844","description":"Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.","status":"published","published":"2017-01-18T17:59:00Z","modified":"2026-02-04T02:26:16.414305Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-741-1","title":"unzip - security update","status":"published","published":"2016-12-13T00:00:00Z","modified":"2026-03-09T02:11:04.835435Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2017-0015","title":"Updated unzip package fixes security vulnerabilities","description":"It was discovered that \"unzip -l\" (CVE-2014-9913) and \"zipinfo\"\n(CVE-2016-9844) were vulnerable to buffer overflows when provided\nmalformed or maliciously-crafted ZIP files.\n","status":"published","published":"2017-01-13T10:32:16Z","modified":"2026-04-16T06:24:07.455687493Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11485-1","title":"unzip-6.00-39.1 on GA media","description":"These are all security issues fixed in the unzip-6.00-39.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:40.428489Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:0639-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993)\n- CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110)\n- CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111)\n- CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992)\n","status":"published","published":"2017-03-06T10:25:18Z","modified":"2026-02-04T02:33:53.542662Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2018:2978-1","title":"Security update for unzip","description":"This update for unzip fixes the following security issues:\n\n- CVE-2014-9913: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013993)\n- CVE-2015-7696: Specially crafted zip files with password protection could\n  trigger a crash and lead to denial of service (bsc#950110)\n- CVE-2015-7697: Specially crafted zip files could trigger an endless loop and\n  lead to denial of service (bsc#950111)\n- CVE-2016-9844: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013992)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074).\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442).\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n","status":"published","published":"2018-10-02T14:30:55Z","modified":"2026-02-04T03:44:07.531458Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-4672-1","title":"unzip vulnerabilities","description":"Rene Freingruber discovered that unzip incorrectly handled certain\nspecially crafted password protected ZIP archives. If a user or automated\nsystem using unzip were tricked into opening a specially crafted zip file,\nan attacker could exploit this to cause a crash, resulting in a denial of\nservice. (CVE-2018-1000035)\n\nAntonio Carista discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n(CVE-2018-18384)\n\nIt was discovered that unzip incorrectly handled certain specially crafted\nZIP archives. If a user or automated system using unzip were tricked into\nopening a specially crafted zip file, an attacker could exploit this to\ncause resource consumption, resulting in a denial of service.\n(CVE-2019-13232)\n\nMartin Carpenter discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04\nLTS. (CVE-2014-9913)\n\nAlexis Vanden Eijnde discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04\nLTS. (CVE-2016-9844)\n","status":"published","published":"2020-12-16T17:27:07Z","modified":"2026-06-29T13:48:08.480259798Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}