REDHAT-BUG-1174856: Low severity info-zip zip vulnerability
oCERT reports an unzip flaw discovered by Michele Spagnuolo, Google Security Team:
""" The read errors show problems in process.c:getZip64Data(), which lacked any error detection or reporting, and was trying to extract multi-byte data from a buffer which did not contain enough bytes.
Proposed changes:
http://antinode.info/ftp/info-zip/unzip60/fileio.c fileio.c:dostring() looks at the status value returned from process.c:getZip64Data(), and puts out a new warning. http://antinode.info/ftp/info-zip/unzip60/process.c process.c:getZip64Data() gets new validity tests, and it returns a useful status value. """
Acknowledgement:
Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1174856?
The severity of REDHAT-BUG-1174856 is considered high due to the unzip flaw that can lead to improper error handling and potential data extraction issues.
How do I fix REDHAT-BUG-1174856?
To fix REDHAT-BUG-1174856, update to the latest version of Info-ZIP Unzip that addresses the vulnerability promptly.
What software is affected by REDHAT-BUG-1174856?
REDHAT-BUG-1174856 affects Info-ZIP Unzip across various versions.
What kind of attack can REDHAT-BUG-1174856 lead to?
REDHAT-BUG-1174856 can lead to data corruption or extraction issues due to improper handling of ZIP file structures.
Who discovered the flaw reported in REDHAT-BUG-1174856?
The flaw reported in REDHAT-BUG-1174856 was discovered by Michele Spagnuolo from the Google Security Team.