UnZip: User-assisted execution of arbitrary code

UnZip: User-assisted execution of arbitrary code Multiple vulnerabilities have been found in UnZip, the worst of which could result in the execution of arbitrary code. unzip 2020-03-26 2020-03-26 647008 691566 local, remote 6.0_p25 6.0_p25

Info-ZIP’s UnZip is a tool to list and extract files inside PKZIP compressed files.

Multiple vulnerabilities have been discovered in UnZip. Please review the CVE identifiers referenced below for details.

A remote attacker could entice a user to open a specially crafted ZIP archive using UnZip, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

There is no known workaround at this time.

All UnZip users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=app-arch/unzip-6.0_p25"

CVE-2018-1000035 CVE-2019-13232 whissi whissi