PT-2022-7197 · Unzip+5 · Unzip+5

Pedro Sampaio · Published 2022-01-11 · Updated 2025-08-12 · CVE-2021-4217

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions unzip (affected versions not specified)

Description A flaw was found in the handling of Unicode strings, which can lead to a null pointer dereference. This issue allows an attacker to input a specially crafted zip file, potentially leading to a crash or code execution. The vulnerability can be exploited by providing a malicious zip file, resulting in a denial of service or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2022-2769

ALT-PU-2022-2845

ALT-PU-2022-2912

ALT-PU-2022-2950

ALT-PU-2022-2972

ALT-PU-2022-2974

AZL-10680

AZL-35342

BDU:2023-09078

CVE-2021-4217

ECHO-D2DD-C0A4-1D52

MGASA-2022-0371

OESA-2022-1902

USN-5673-1

USN-7054-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Ubuntu

Unzip

References · 40

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2044583 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4217 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7054-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35342 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5673-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4217 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3118 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4217 · Security Note
• https://bdu.fstec.ru/vul/2023-09078 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4217 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2021-4217 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0371 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0529 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1902 · Vendor Advisory