UnZip: Multiple vulnerabilities — GLSA 201611-01

Multiple vulnerabilities have been found in UnZip allowing remote attackers to execute arbitrary code and cause Denial of Service.

Affected packages

app-arch/unzip on all architectures
Affected versions < 6.0_p20
Unaffected versions >= 6.0_p20

Background

Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.

Description

Multiple vulnerabilities were found in UnZip. Please review the referenced CVE’s for additional information.

Impact

Remote attackers could execute arbitrary code or cause Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All UnZip users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p20"
 

References

Release date
November 01, 2016

Latest revision
November 01, 2016: 1

Severity
normal

Exploitable
remote

Bugzilla entries