{"id":"CVE-2021-4217","aliases":["ALPINE-CVE-2021-4217","AZL-10680","AZL-35342","BELL-CVE-2021-4217","CLSA-2026-1778131952","DEBIAN-CVE-2021-4217","EUVD-2021-34075","GHSA-9xxw-h585-3vfj","MGASA-2022-0371","OESA-2022-1902","ROOT-OS-DEBIAN-12-CVE-2021-4217","UBUNTU-CVE-2021-4217","USN-5673-1","USN-7054-1"],"status":"published","title":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings,...","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00618,"percentile":0.50113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-08-24T15:08:43Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-22"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-22"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"unzip","fixed_in":["6.0-47.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"unzip","fixed_in":["6.0-47.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"unzip","fixed_in":["6.0-50.oe2203"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"unzip","fixed_in":["6.0-28+deb12u1.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-unzip","fixed_in":["6.0-28+deb12u1.aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","fixed_in":["6.0-20ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unzip","fixed_in":["6.0-21ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unzip","fixed_in":["6.0-25ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unzip","fixed_in":["6.0-26ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"unzip","fixed_in":["6.0-28ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-22"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-22"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-56.el9_2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0-28","6.0-28+deb12u1","6.0-29","6.0-30","6.0-31"]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0-29","6.0-29+deb13u1","6.0-30","6.0-31"]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0-29","6.0-30","6.0-31"]},{"source":"osv","ecosystem":"Mageia:8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-2.1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-47.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-47.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-50.oe2203"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-28+deb12u1.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-28+deb12u1.aikido.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6+esm1"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5","6.0-9ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1+esm1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1","6.0-20ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.2"}]}],"versions":["6.0-21ubuntu1","6.0-21ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-25ubuntu1.1"}]}],"versions":["6.0-25ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-26ubuntu3.1"}]}],"versions":["6.0-26ubuntu1","6.0-26ubuntu2","6.0-26ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-28ubuntu4.1"}]}],"versions":["6.0-28ubuntu1","6.0-28ubuntu2","6.0-28ubuntu3","6.0-28ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6+esm1"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5","6.0-9ubuntu1.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1+esm1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1","6.0-20ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.2"}]}],"versions":["6.0-21ubuntu1","6.0-21ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-25ubuntu1.1"}]}],"versions":["6.0-25ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-26ubuntu3.1"}]}],"versions":["6.0-26ubuntu1","6.0-26ubuntu2","6.0-26ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-28ubuntu4.1"}]}],"versions":["6.0-28ubuntu1","6.0-28ubuntu2","6.0-28ubuntu3","6.0-28ubuntu4"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"info-zip","product":"unzip"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044583","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4217","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4217","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9xxw-h585-3vfj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-4217","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-4217","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778131952.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4217","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0371.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051402","tags":["report"]},{"url":"https://www.debian.org/security/2022/dsa-5202","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3118","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VFUXYMOCMRAV3GMQQKYX6T4L2I23XSQU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5673-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1902","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4217","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7054-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0530","tags":["report"]},{"url":"https://launchpad.net/bugs/1957077","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T15:08:43Z","modified":"2026-11-02T18:11:46.107Z","cwes":["CWE-476"],"updated_at":"2026-11-02T19:47:06.831391Z"}],"euvd":[{"id":"EUVD-2021-34075","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T15:08:43Z","modified":"2026-11-02T18:11:46Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-9xxw-h585-3vfj","title":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings,...","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-25T00:00:27Z","modified":"2023-02-01T05:08:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:50:45.067904Z"}],"nvd":[{"id":"CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10.09Z","modified":"2026-11-02T19:17:46.99Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-03T00:01:40.46005Z"}],"osv":[{"id":"ALPINE-CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10.09Z","modified":"2026-10-23T17:17:56.217346722Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-10680","title":"CVE-2021-4217 affecting package unzip for versions less than 6.0-22","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10Z","modified":"2026-04-21T04:21:25.447916Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-35342","title":"CVE-2021-4217 affecting package unzip for versions less than 6.0-22","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"BELL-CVE-2021-4217","title":"CVE-2021-4217 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:28.304394Z","modified":"2026-01-26T10:04:50.551741Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10.09Z","modified":"2026-04-16T04:42:33.550829797Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:10.09Z","modified":"2026-11-03T09:47:40.274934563Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"OESA-2022-1902","title":"unzip security update","description":"UnZip is an extraction utility for archives compressed in .zip format. UnZip will list, test, or extract files from a .zip archive, commonly found on MS-DOS systems. The default behavior (with no options) is to extract all files into the current directory (and subdirectorie below it) from the specified zipfile.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.(CVE-2021-4217)","status":"published","published":"2022-09-09T11:05:11Z","modified":"2026-08-18T01:16:54.896793338Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2021-4217","title":"CVE-2021-4217 in unzip - Patched by Root","description":"Root has patched CVE-2021-4217 in the unzip package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-08T10:03:44Z","modified":"2026-10-08T11:15:03.045133769Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2021-4217","description":"A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-08-24T16:15:00Z","modified":"2026-02-04T04:03:05.222751Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"CLSA-2026-1778131952","title":"unzip: Fix of 3 CVEs","description":"- CVE-2021-4217: fix null pointer dereference in EF_UNIPATH extra field handling\n- CVE-2022-0529: fix heap-based buffer overflow in wide_to_local_string\n- CVE-2022-0530: fix null pointer dereference on invalid UTF-8 input","status":"published","published":"2026-05-07T05:32:38Z","modified":"2026-06-01T00:32:29.592257794Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2022-0371","title":"Updated unzip packages fix security vulnerability","description":"Improper handling of Unicode strings, which can lead to a null pointer\ndereference. This flaw allows an attacker to input a specially crafted zip\nfile, leading to a crash or code execution. (CVE-2021-4217)\n\nConversion of a wide string to a local string that leads to a heap of\nout-of-bound write. This flaw allows an attacker to input a specially\ncrafted zip file, leading to a crash or code execution. (CVE-2022-0529,\nCVE-2022-0530)\n","status":"published","published":"2022-10-18T23:14:56Z","modified":"2026-04-16T04:41:39.448372597Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-5673-1","title":"unzip vulnerabilities","description":"It was discovered that unzip did not properly handle unicode strings under\ncertain circumstances. If a user were tricked into opening a specially crafted\nzip file, an attacker could possibly use this issue to cause unzip to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2021-4217)\n\nIt was discovered that unzip did not properly perform bounds checking while\nconverting wide strings to local strings. If a user were tricked into opening a\nspecially crafted zip file, an attacker could possibly use this issue to cause\nunzip to crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-0529, CVE-2022-0530)\n","status":"published","published":"2022-10-13T09:26:04Z","modified":"2026-06-29T13:48:24.886425704Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-7054-1","title":"unzip vulnerability","description":"It was discovered that unzip did not properly handle unicode strings under\ncertain circumstances. If a user were tricked into opening a specially\ncrafted zip file, an attacker could possibly use this issue to cause unzip\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2024-10-03T11:53:28Z","modified":"2026-02-10T04:45:27Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}