CVE-2022-0529: Medium severity unzip vulnerability
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Other sources
Heap out-of-bound writes and reads during conversion of wide string to local string https://bugzilla.redhat.com/showbug.cgi?id=2048572
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0529?
CVE-2022-0529 is a vulnerability found in Unzip that allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
How severe is CVE-2022-0529?
CVE-2022-0529 has a severity rating of 5.5 (medium).
Which software versions are affected by CVE-2022-0529?
Versions 6.0-23+deb10u2, 6.0-23+deb10u3, 6.0-26+deb11u1, and 6.0-28 of the Unzip package in Debian, as well as Unzip 6.0, Redhat Enterprise Linux 8.0, Fedoraproject Fedora 35, Debian Debian Linux 10.0, and Debian Debian Linux 11.0 are affected by CVE-2022-0529.
How can I fix CVE-2022-0529?
To fix CVE-2022-0529, update the Unzip package to version 6.0-23+deb10u3 or a later version.
Where can I find more information about CVE-2022-0529?
You can find more information about CVE-2022-0529 at the following references: [1](https://security-tracker.debian.org/tracker/CVE-2022-0530), [2](https://github.com/ByteHackr/unzip_poc), [3](https://security-tracker.debian.org/tracker/CVE-2022-0529).