PT-2018-3009 · Info Zip+3 · Unzip+3

Published 2018-02-09 · Updated 2024-06-15 · CVE-2018-1000035

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Info-Zip UnZip versions prior to 6.00

Description A heap-based buffer overflow issue exists in the processing of password-protected archives, allowing an attacker to perform a denial of service or possibly achieve code execution. The vulnerability can be exploited by a remote attacker to cause a disruption in service.

Recommendations For versions prior to 6.00, update to version 6.00 or later to resolve the issue. As a temporary workaround, consider avoiding the use of password-protected archives until a patch is available. Restrict access to the archive processing functionality to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2020-3276

ALT-PU-2020-3281

ALT-PU-2020-3294

AZL-35339

AZL-6941

BDU:2019-03340

CVE-2018-1000035

DLA-2082-1

MGASA-2018-0422

OPENSUSE-SU-2018_1914-1

OPENSUSE-SU-2018_3043-1

OPENSUSE-SU-2024:11485-1

SUSE-SU-2018:0465-1

SUSE-SU-2018:1883-1

SUSE-SU-2018:2978-1

SUSE-SU-2018_0465-1

USN-4672-1

Affected Products

Alt Linux

Suse

Ubuntu

Unzip

References · 51

• https://ubuntu.com/security/CVE-2016-9844 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000035 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-58 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000035 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4672-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11485-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000035 · Security Note
• https://osv.dev/vulnerability/AZL-35339 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18384 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0422.html · Security Note
• https://osv.dev/vulnerability/DLA-2082-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000035 · Security Note