Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.
The NEEDBITS macro in the inflatedynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.
An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.
An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execution.
A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execution.
Buffer overflow in the charsettointern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.
Wiz 5.0.3 has a user mode write access violation
Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.
References:
https://bugzilla.suse.com/showbug.cgi?id=1110194 https://sourceforge.net/p/infozip/bugs/53/ https://src.fedoraproject.org/rpms/unzip/blob/master/f/unzip-6.0-overflow-long-fsize.patch
oCERT reports an unzip flaw discovered by Michele Spagnuolo, Google Security Team:
""" The read errors show problems in process.c:getZip64Data(), which lacked any error detection or reporting, and was trying to extract multi-byte data from a buffer which did not contain enough bytes.
Proposed changes:
http://antinode.info/ftp/info-zip/unzip60/fileio.c fileio.c:dostring() looks at the status value returned from process.c:getZip64Data(), and puts out a new warning. http://antinode.info/ftp/info-zip/unzip60/process.c process.c:getZip64Data() gets new validity tests, and it returns a useful status value. """
Acknowledgement:
Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.