An update of the unzip package has been released.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unzip fixes the following issues :

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793350631 advisory.

  - A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-     protected archives that allows an attacker to perform a denial of service or to possibly achieve code     execution. (CVE-2018-1000035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for unzip fixes the following security issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074).

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442).

This non-security issue was fixed :

  - Allow processing of Windows zip64 archives (Windows     archivers set total_disks field to 0 but per standard,     valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-12:Update update project.

The CentOS Linux 7.9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1650 advisory.

    This advisory aggregates security fixes for the unzip SRPM in CIQ CentOS Bridge 7.9. It addresses 9 CVEs:
    CVE-2019-13232, CVE-2018-1000035, CVE-2005-4667, CVE-2008-0888, CVE-2014-8139, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Buffer overflow in the list_files function in list.c in     Info-Zip UnZip 6.0 allows remote attackers to cause a     denial of service (crash) via vectors related to the     compression method.(CVE-2014-9913)

  - Buffer overflow in the zi_short function in zipinfo.c     in Info-Zip UnZip 6.0 allows remote attackers to cause     a denial of service (crash) via a large compression     method value in the central directory file     header.(CVE-2016-9844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 mishandles the overlapping of files     inside a ZIP container, leading to denial of service     (resource consumption), aka a 'better zip bomb'     issue.(CVE-2019-13232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
204444	Photon OS 4.0: Unzip PHSA-2023-4.0-0397	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/11/2	high
132212	EulerOS 2.0 SP3 : unzip (EulerOS-SA-2019-2677)	Nessus	Huawei Local Security Checks	2019/12/18	2021/1/6	high
203629	Photon OS 5.0: Unzip PHSA-2023-5.0-0057	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/10/14	high
120030	SUSE SLED15 / SLES15 Security Update : unzip (SUSE-SU-2018:1883-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	high
375666	CentOS Linux 6 [TuxCare] Security Update: unzip (CENTOS6:CLSA-2026:1793350631)	Nessus	CentOS Local Security Checks	2026/11/3	2026/11/3	high
117981	openSUSE Security Update : unzip (openSUSE-2018-1124)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
369924	CentOS Linux 7.9 [CIQ] Security Update: unzip Multiple Vulnerabilities (ciqsa-2026_1650)	Nessus	CentOS Local Security Checks	2026/10/21	2026/10/21	high
332628	Photon OS 5.0: Unzip PHSA-2023-5.0-91-0057	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	high
131583	EulerOS 2.0 SP2 : unzip (EulerOS-SA-2019-2429)	Nessus	Huawei Local Security Checks	2019/12/4	2021/1/6	high
135624	EulerOS Virtualization 3.0.2.2 : unzip (EulerOS-SA-2020-1462)	Nessus	Huawei Local Security Checks	2020/4/16	2021/1/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high