{"id":"CVE-2022-0529","aliases":["ALPINE-CVE-2022-0529","AZL-35343","AZL-8532","BELL-CVE-2022-0529","CLSA-2026-1778131952","CLSA-2026-1778132770","DEBIAN-CVE-2022-0529","DLA-3118-1","DSA-5202-1","EUVD-2022-15655","GHSA-wj94-fvj2-f29x","MGASA-2022-0371","OESA-2022-1548","SUSE-SU-2022:3386-1","SUSE-SU-2022:3399-1","UBUNTU-CVE-2022-0529","USN-5673-1","openSUSE-SU-2024:12357-1"],"status":"published","title":"A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of wide string to...","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02421,"percentile":0.84294,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2022-02-09T22:05:51Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"ByteHackr/unzip_poc","title":"ByteHackr/unzip_poc","date":"2022-02-28","url":"https://github.com/ByteHackr/unzip_poc"},{"source":"pocgithub","id":"nanaao/unzip_poc","title":"nanaao/unzip_poc","date":"2022-02-28","url":"https://github.com/nanaao/unzip_poc"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-21"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unzip","fixed_in":["6.0-27"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unzip","fixed_in":["6.0-27"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unzip","fixed_in":["6.0-27"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","fixed_in":["6.0-20ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"unzip","fixed_in":["6.0-21ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unzip","fixed_in":["6.0-25ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unzip","fixed_in":["6.0-26ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-56.el9_2.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-58.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-27"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-27"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-27"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-23+deb10u3"}]}],"versions":["6.0-23","6.0-23+deb10u1","6.0-23+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-26+deb11u1"}]}],"versions":["6.0-26"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-2.1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-46.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-46.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-46.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-150000.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-150000.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-150000.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-150000.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6+esm1"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5","6.0-9ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1+esm1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1","6.0-20ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.2"}]}],"versions":["6.0-21ubuntu1","6.0-21ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-25ubuntu1.1"}]}],"versions":["6.0-25ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-26ubuntu3.1"}]}],"versions":["6.0-26ubuntu1","6.0-26ubuntu2","6.0-26ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.6+esm1"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4","6.0-9ubuntu1.5","6.0-9ubuntu1.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20ubuntu1.1+esm1"}]}],"versions":["6.0-17ubuntu1","6.0-19ubuntu1","6.0-19ubuntu2","6.0-20ubuntu1","6.0-20ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-21ubuntu1.2"}]}],"versions":["6.0-21ubuntu1","6.0-21ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-25ubuntu1.1"}]}],"versions":["6.0-25ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-26ubuntu3.1"}]}],"versions":["6.0-26ubuntu1","6.0-26ubuntu2","6.0-26ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-40.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"info-zip","product":"unzip"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051395","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/ByteHackr/unzip_poc","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://www.debian.org/security/2022/dsa-5202","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-17","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0529","tags":["web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051402","tags":["report"]},{"url":"https://github.com/advisories/GHSA-wj94-fvj2-f29x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-0529","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-0529","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778131952.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778132770.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0529","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0371.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29893","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044583","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3118","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VFUXYMOCMRAV3GMQQKYX6T4L2I23XSQU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5673-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0530","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196177","tags":["report"]},{"url":"https://bugzilla.suse.com/1196180","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0530","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223399-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0529","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0530","tags":["report"]},{"url":"https://launchpad.net/bugs/1957077","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T22:05:51Z","modified":"2026-10-08T21:03:12.511Z","updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15655","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T22:05:51Z","modified":"2026-10-08T21:03:12Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-wj94-fvj2-f29x","title":"A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of wide string to...","description":"A flaw was found in unzip 6.0. The vulnerability occurs during the conversion of wide string to local string that leads to a heap of out-of-bound writes. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-11T00:00:53Z","modified":"2023-10-30T12:30:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:48.16134Z"}],"nvd":[{"id":"CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16.627Z","modified":"2026-10-08T21:17:43.59Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"ALPINE-CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16.627Z","modified":"2026-11-03T07:18:32.998134504Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-35343","title":"CVE-2022-0529 affecting package unzip for versions less than 6.0-21","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-8532","title":"CVE-2022-0529 affecting package unzip for versions less than 6.0-21","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16Z","modified":"2026-04-21T04:34:51.99196Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"BELL-CVE-2022-0529","title":"CVE-2022-0529 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:20.801388Z","modified":"2026-01-26T09:47:49.545486Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16.627Z","modified":"2026-04-16T04:40:18.68715481Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:16.627Z","modified":"2026-11-03T08:00:23.854186057Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2022-1548","title":"unzip security update","description":"A utility for unpacking zip files.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.(CVE-2022-0530)\r\n\r\nA flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.(CVE-2022-0529)","status":"published","published":"2022-03-07T11:04:49Z","modified":"2026-08-18T01:16:21.028564193Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-0529","description":"A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.","status":"published","published":"2022-02-09T23:15:00Z","modified":"2026-02-04T03:25:24.486974Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CLSA-2026-1778131952","title":"unzip: Fix of 3 CVEs","description":"- CVE-2021-4217: fix null pointer dereference in EF_UNIPATH extra field handling\n- CVE-2022-0529: fix heap-based buffer overflow in wide_to_local_string\n- CVE-2022-0530: fix null pointer dereference on invalid UTF-8 input","status":"published","published":"2026-05-07T05:32:38Z","modified":"2026-06-01T00:32:29.592257794Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778132770","title":"unzip: Fix of 2 CVEs","description":"- CVE-2022-0529: fix heap-based buffer overflow in wide_to_local_string\n- CVE-2022-0530: fix null pointer dereference on invalid UTF-8 input","status":"published","published":"2026-05-07T08:06:32Z","modified":"2026-06-01T00:32:02.174358481Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3118-1","title":"unzip - security update","status":"published","published":"2022-09-22T00:00:00Z","modified":"2026-03-09T01:18:24.357402Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5202-1","title":"unzip - security update","status":"published","published":"2022-08-08T00:00:00Z","modified":"2026-03-09T02:08:49.115733Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0371","title":"Updated unzip packages fix security vulnerability","description":"Improper handling of Unicode strings, which can lead to a null pointer\ndereference. This flaw allows an attacker to input a specially crafted zip\nfile, leading to a crash or code execution. (CVE-2021-4217)\n\nConversion of a wide string to a local string that leads to a heap of\nout-of-bound write. This flaw allows an attacker to input a specially\ncrafted zip file, leading to a crash or code execution. (CVE-2022-0529,\nCVE-2022-0530)\n","status":"published","published":"2022-10-18T23:14:56Z","modified":"2026-04-16T04:41:39.448372597Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12357-1","title":"unzip-6.00-40.1 on GA media","description":"These are all security issues fixed in the unzip-6.00-40.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:38.471841Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3386-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2022-0530: Fixed SIGSEGV during the conversion of an utf-8 string to a local string (bsc#1196177).\n- CVE-2022-0529: Fixed heap out-of-bound writes and reads during conversion of wide string to local string (bsc#1196180).\n","status":"published","published":"2022-09-26T10:41:57Z","modified":"2026-02-04T03:53:50.291331Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3399-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2022-0530: Fixed SIGSEGV during the conversion of an utf-8 string to a local string (bsc#1196177).\n- CVE-2022-0529: Fixed heap out-of-bound writes and reads during conversion of wide string to local string (bsc#1196180)\n","status":"published","published":"2022-09-26T14:41:11Z","modified":"2026-02-04T02:44:00.064668Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5673-1","title":"unzip vulnerabilities","description":"It was discovered that unzip did not properly handle unicode strings under\ncertain circumstances. If a user were tricked into opening a specially crafted\nzip file, an attacker could possibly use this issue to cause unzip to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2021-4217)\n\nIt was discovered that unzip did not properly perform bounds checking while\nconverting wide strings to local strings. If a user were tricked into opening a\nspecially crafted zip file, an attacker could possibly use this issue to cause\nunzip to crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2022-0529, CVE-2022-0530)\n","status":"published","published":"2022-10-13T09:26:04Z","modified":"2026-06-29T13:48:24.886425704Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}