CVE-2022-0529

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

Published: Feb 10, 2022
Updated: Apr 14, 2023
CVE: CVE-2022-0529
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.5
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-787

Affected Software
References

Software	From	Fixed in
unzip_project / unzip	6.0	6.0.x
redhat / enterprise_linux	8.0	8.0.x
fedoraproject / fedora	35	35.x
debian / debian_linux	10.0	10.0.x
debian / debian_linux	11.0	11.0.x

https://bugzilla.redhat.com/show_bug.cgi?id=2051395
https://github.com/ByteHackr/unzip_poc
https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html
https://security.gentoo.org/glsa/202310-17
https://www.debian.org/security/2022/dsa-5202

Vulnerability Database

CVE-2022-0529

Deep Security Visibility Without the Complexity