CVE-2019-13232 Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
LowCVSS 3.3
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/unzip(Debian:12) | < 6.0-24 | 6.0-24 |
| debian/unzip(Debian:13) | < 6.0-24 | 6.0-24 |
| debian/unzip(Debian:14) | < 6.0-24 | 6.0-24 |
| unzip project unzip | = 6.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| alpine/unzip(Alpine:v3.10) | < 6.0-r6 | 6.0-r6 |
| alpine/unzip(Alpine:v3.11) | < 6.0-r6 | 6.0-r6 |
| alpine/unzip(Alpine:v3.12) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.13) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.14) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.15) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.16) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.17) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.18) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.19) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.20) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.21) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.22) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.23) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.24) | < 6.0-r7 | 6.0-r7 |
| alpine/unzip(Alpine:v3.8) | < 6.0-r6 | 6.0-r6 |
| alpine/unzip(Alpine:v3.9) | < 6.0-r6 | 6.0-r6 |
References
- Debian Security Tracker CVE-2019-13232 vendor-advisory
- github.com product release-notes third-party-advisory
- [debian-lts-announce] 20190707 [SECURITY] [DLA 1846-1] unzip security update mailing-list third-party-advisory
- [debian-lts-announce] 20190728 [SECURITY] [DLA 1846-2] unzip regression update mailing-list third-party-advisory
- GLSA-202003-58 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- support.f5.com
- www.bamsoftware.com third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking