[ GLSA 200804-06 ] UnZip: User-assisted execution of arbitrary code

[GLSA]

Gentoo Linux Security Advisory

Title: UnZip: User-assisted execution of arbitrary code (GLSA 200804-06)
Severity: normal
Exploitable: remote
Date: April 06, 2008
Bug(s): #213761
ID: 200804-06

Synopsis

A double free vulnerability discovered in UnZip might lead to the execution of arbitrary code.

Background

Info-ZIP's UnZip is a tool to list and extract files inside PKZIP compressed files.

Affected Packages

Package: app-arch/unzip
Vulnerable: < 5.52-r2
Unaffected: >= 5.52-r2
Architectures: All supported architectures


Description

Tavis Ormandy of the Google Security Team discovered that the NEEDBITS macro in the inflate_dynamic() function in the file inflate.c can be invoked using invalid buffers, which can lead to a double free.

Impact

Remote attackers could entice a user or automated system to open a specially crafted ZIP file that might lead to the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All UnZip users should upgrade to the latest version: