CVE-2022-0530
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bounds write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Risk Assessment
This vulnerability could allow remote code execution or application crash when processing untrusted ZIP archives, posing a serious risk to the organization.
Recommendation
Update Unzip to the latest version and avoid processing untrusted ZIP files.
Other vulnerabilities in Unzip
See all- CVE-2021-4217Low
A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.
- CVE-2022-0529Medium
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Original NVD description (English source)
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS