CVE-2022-0529
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Risk Assessment
The organization may be exposed to attacks using malicious ZIP files, potentially leading to system compromise or code execution.
Recommendation
Upgrade Unzip to the latest patched version and exercise caution when opening ZIP files from untrusted sources.
Other vulnerabilities in Unzip
See all- CVE-2021-4217Low
A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.
- CVE-2022-0530Medium
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bounds write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Original NVD description (English source)
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS