Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

Unzip may be slowed by specially crafted zip files

published 7 years ago
Summary

The Unzip utility (versions earlier than 6.0-20) can be tricked into using excessive system resources when it processes a zip file with overlapping entries. This can cause the program to become unresponsive and affect any system that relies on Unzip for extracting archives. Update Unzip to the latest version or avoid extracting untrusted zip files to prevent the slowdown.

What to do
  • Update azure unzip to version 6.0-20.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure unzip < 6.0-20
Fix: upgrade to 6.0-20
Original advisory text
CVE-2019-13232 affecting package unzip for versions less than 6.0-20
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.3 Low
Timeline
Published4 Jul 2019
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-35341 · OSV
Track software like this
Free during beta