Medium · published February 10, 2022
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
| Product | Versions | Fixed in |
|---|---|---|
| unzip_project/unzip | all versions | — |
| redhat/enterprise_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| apple/mac_os_x | ≥ 10.15, < 10.15.7 | 10.15.7 |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/mac_os_x | all versions | — |
| apple/macos | ≥ 11.0, < 11.6.6 | 11.6.6 |
| apple/macos | ≥ 12.0.0, < 12.4 | 12.4 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |