{"id":"CVE-2018-1000035","aliases":["ALPINE-CVE-2018-1000035","AZL-35339","AZL-6941","BELL-CVE-2018-1000035","DEBIAN-CVE-2018-1000035","DLA-2082-1","EUVD-2018-1796","GHSA-v5xf-cfj4-rv57","MGASA-2018-0422","SUSE-SU-2018:0465-1","SUSE-SU-2018:1883-1","SUSE-SU-2018:2978-1","UBUNTU-CVE-2018-1000035","USN-4672-1","openSUSE-SU-2024:11485-1"],"status":"published","title":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of...","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.30066,"percentile":0.98223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-02-09T23:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-19"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unzip","fixed_in":["6.0-22"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unzip","fixed_in":["6.0-22"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unzip","fixed_in":["6.0-22"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"unzip","fixed_in":["6.0-16+deb8u6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"unzip","fixed_in":["6.00-11.18.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"unzip","fixed_in":["6.00-11.18.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"unzip","fixed_in":["6.0-20ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unzip","fixed_in":["6.0-21ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-22"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-22"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-22"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-16+deb8u6"}]}],"versions":["6.0-16","6.0-16+deb8u1","6.0-16+deb8u2","6.0-16+deb8u3","6.0-16+deb8u4","6.0-16+deb8u5"]},{"source":"osv","ecosystem":"Mageia:6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1c-1.1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-11.18.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-11.18.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.1"}]}],"versions":["6.0-21ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.1"}]}],"versions":["6.0-21ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-39.1"}]}],"bundled":5}],"products":[{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-58","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000035","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v5xf-cfj4-rv57"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1000035","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-1000035","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000035","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0422.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22571","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/02/08/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180465-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080074","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/910683","tags":["report"]},{"url":"https://bugzilla.suse.com/914442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182978-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013992","tags":["report"]},{"url":"https://bugzilla.suse.com/1013993","tags":["report"]},{"url":"https://bugzilla.suse.com/950110","tags":["report"]},{"url":"https://bugzilla.suse.com/950111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9844","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1000035","tags":["report"]},{"url":"https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4672-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13232","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18384","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48.718Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1796","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-v5xf-cfj4-rv57","title":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of...","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2022-05-13T01:18:43Z","modified":"2023-02-01T05:05:32Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:15.334804Z"}],"nvd":[{"id":"CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01.213Z","modified":"2026-06-17T01:32:15.457Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"ALPINE-CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01.213Z","modified":"2026-10-23T17:17:55.149223078Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"AZL-35339","title":"CVE-2018-1000035 affecting package unzip for versions less than 6.0-20","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6941","title":"CVE-2018-1000035 affecting package unzip for versions less than 6.0-19","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01Z","modified":"2026-04-21T04:38:35.627569Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"BELL-CVE-2018-1000035","title":"CVE-2018-1000035 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:31.229859Z","modified":"2026-01-26T09:47:08.363211Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01.213Z","modified":"2026-04-16T06:21:28.334328327Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:01.213Z","modified":"2026-10-23T18:03:17.37967182Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.","status":"published","published":"2018-02-09T23:29:00Z","modified":"2026-02-04T03:27:07.478402Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-2082-1","title":"unzip - security update","status":"published","published":"2020-01-28T00:00:00Z","modified":"2026-03-09T01:22:57.684438Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2018-0422","title":"Updated unzip packages fix security vulnerabilities","description":"Updated unzip packages fix security vulnerabilities\n\nHeap-based out-of-bounds write (CVE-2018-1000031).\n\nHeap/BSS-based buffer overflow (Bypass of CVE-2015-1315)\n(CVE-2018-1000032).\n\nHeap out-of-bounds access in ef_scan_for_stream (CVE-2018-1000033).\n\nMultiple vulnerabilities in the LZMA compression algorithm\n(CVE-2018-1000034).\n\nHeap-based buffer overflow in password protected ZIP archives\n(CVE-2018-1000035).\n","status":"published","published":"2018-10-30T18:01:43Z","modified":"2026-04-16T06:26:00.181554714Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11485-1","title":"unzip-6.00-39.1 on GA media","description":"These are all security issues fixed in the unzip-6.00-39.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:40.428489Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0465-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2018-1000035: Fixed a heap-based buffer overflow in password protected ZIP archives (bsc#1080074)\n","status":"published","published":"2018-02-16T15:00:31Z","modified":"2026-02-04T02:46:10.18873Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1883-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074)\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n","status":"published","published":"2018-07-05T06:38:08Z","modified":"2026-02-04T02:16:23.583663Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2978-1","title":"Security update for unzip","description":"This update for unzip fixes the following security issues:\n\n- CVE-2014-9913: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013993)\n- CVE-2015-7696: Specially crafted zip files with password protection could\n  trigger a crash and lead to denial of service (bsc#950110)\n- CVE-2015-7697: Specially crafted zip files could trigger an endless loop and\n  lead to denial of service (bsc#950111)\n- CVE-2016-9844: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013992)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074).\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442).\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n","status":"published","published":"2018-10-02T14:30:55Z","modified":"2026-02-04T03:44:07.531458Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-4672-1","title":"unzip vulnerabilities","description":"Rene Freingruber discovered that unzip incorrectly handled certain\nspecially crafted password protected ZIP archives. If a user or automated\nsystem using unzip were tricked into opening a specially crafted zip file,\nan attacker could exploit this to cause a crash, resulting in a denial of\nservice. (CVE-2018-1000035)\n\nAntonio Carista discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n(CVE-2018-18384)\n\nIt was discovered that unzip incorrectly handled certain specially crafted\nZIP archives. If a user or automated system using unzip were tricked into\nopening a specially crafted zip file, an attacker could exploit this to\ncause resource consumption, resulting in a denial of service.\n(CVE-2019-13232)\n\nMartin Carpenter discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04\nLTS. (CVE-2014-9913)\n\nAlexis Vanden Eijnde discovered that unzip incorrectly handled certain\nspecially crafted ZIP archives. If a user or automated system using unzip\nwere tricked into opening a specially crafted zip file, an attacker could\nexploit this to cause a crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04\nLTS. (CVE-2016-9844)\n","status":"published","published":"2020-12-16T17:27:07Z","modified":"2026-06-29T13:48:08.480259798Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}