[ GLSA 202003-58 ] UnZip

[GLSA]

Gentoo Linux Security Advisory

Title: UnZip: User-assisted execution of arbitrary code (GLSA 202003-58)
Severity: normal
Exploitable: local, remote
Date: 2020-03-26
Bug(s): #647008, #691566
ID: 202003-58

Synopsis

Multiple vulnerabilities have been found in UnZip, the worst of
which could result in the execution of arbitrary code.


Background

Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP
compressed files.


Affected Packages

Package: app-arch/unzip
Vulnerable: < 6.0_p25
Unaffected: >= 6.0_p25
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in UnZip. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker could entice a user to open a specially crafted ZIP
archive using UnZip, possibly resulting in execution of arbitrary code
with the privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All UnZip users should upgrade to the latest version: