{"id":"USN-2788-2","aliases":[],"status":"published","title":"unzip regression","description":"USN-2788-1 fixed vulnerabilities in unzip. One of the security patches\ncaused a regression when extracting 0-byte files. This update fixes the\nproblem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Gustavo Grieco discovered that unzip incorrectly handled certain password\n protected archives. If a user or automated system were tricked into\n processing a specially crafted zip archive, an attacker could possibly\n execute arbitrary code. (CVE-2015-7696)\n \n Gustavo Grieco discovered that unzip incorrectly handled certain malformed\n archives. If a user or automated system were tricked into processing a\n specially crafted zip archive, an attacker could possibly cause unzip to\n hang, resulting in a denial of service. (CVE-2015-7697)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-11-09T16:19:30Z","modified":"2026-02-10T04:40:56Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.5"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1","6.0-9ubuntu1.2","6.0-9ubuntu1.3","6.0-9ubuntu1.4"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-2788-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1513293","tags":["report"]}],"sources":{"osv":[{"id":"USN-2788-2","title":"unzip regression","description":"USN-2788-1 fixed vulnerabilities in unzip. One of the security patches\ncaused a regression when extracting 0-byte files. This update fixes the\nproblem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Gustavo Grieco discovered that unzip incorrectly handled certain password\n protected archives. If a user or automated system were tricked into\n processing a specially crafted zip archive, an attacker could possibly\n execute arbitrary code. (CVE-2015-7696)\n \n Gustavo Grieco discovered that unzip incorrectly handled certain malformed\n archives. If a user or automated system were tricked into processing a\n specially crafted zip archive, an attacker could possibly cause unzip to\n hang, resulting in a denial of service. (CVE-2015-7697)\n","status":"published","published":"2015-11-09T16:19:30Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}