Logo
›
›vulnerability›CVE-2019-13232
Name
CVE-2019-13232
Source
NVD ( link)Debian ( link)
Description
Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
CWEs
CWE-400
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/madler/unzipProduct
https://lists.debian.org/debian-lts-announce/2019/07/msg00005.htmlMailing List
https://lists.debian.org/debian-lts-announce/2019/07/msg00027.htmlThird Party Advisory
https://security.gentoo.org/glsa/202003-58Third Party Advisory
https://security.netapp.com/advisory/ntap-20190814-0002/Third Party Advisory
https://www.bamsoftware.com/hacks/zipbomb/Third Party Advisory
https://github.com/madler/unzipProduct
https://lists.debian.org/debian-lts-announce/2019/07/msg00005.htmlMailing List
https://lists.debian.org/debian-lts-announce/2019/07/msg00027.htmlThird Party Advisory
https://security.gentoo.org/glsa/202003-58Third Party Advisory
https://security.netapp.com/advisory/ntap-20190814-0002/Third Party Advisory
https://www.bamsoftware.com/hacks/zipbomb/Third Party Advisory

Analysis#

Affected Component
Analysis
unzip
Patched

Vulnerability Ratings#

3.3
CVSSv31
2.1
CVSSv2

Others affected components#

Name
Project
Project Version
Version
Status
unzip
buildroot
master
6.0
Patched
unzip
yocto
kirkstone
6.0
Patched
unzip
yocto
master
6.0
Patched
unzip
yocto
scarthgap
6.0
Patched

Resolved with patches#

unzip (buildroot:2025.02.x)

#
Title
Author
Resolve
1
Fix bug in undefer_input() that misplaced the input state.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
2
Detect and reject a zip bomb using overlapped entries.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
3
Do not raise a zip bomb alert for a misplaced central directory.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
4
Fix bug in UZbunzip2() that incorrectly updated G.incnt
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
5
Fix bug in UZinflate() that incorrectly updated G.incnt.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232

unzip (buildroot:master)

#
Title
Author
Resolve
1
Fix bug in undefer_input() that misplaced the input state.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
2
Detect and reject a zip bomb using overlapped entries.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
3
Do not raise a zip bomb alert for a misplaced central directory.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
4
Fix bug in UZbunzip2() that incorrectly updated G.incnt
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
5
Fix bug in UZinflate() that incorrectly updated G.incnt.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232

unzip (yocto:kirkstone)

#
Title
Author
Resolve
1
Fix bug in undefer_input() that misplaced the input
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
2
Do not raise a zip bomb alert for a misplaced central
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
3
Detect and reject a zip bomb using overlapped entries.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232

unzip (yocto:master)

#
Title
Author
Resolve
1
Fix bug in undefer_input() that misplaced the input
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
2
Do not raise a zip bomb alert for a misplaced central
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
3
Detect and reject a zip bomb using overlapped entries.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232

unzip (yocto:scarthgap)

#
Title
Author
Resolve
1
Fix bug in undefer_input() that misplaced the input
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
2
Do not raise a zip bomb alert for a misplaced central
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232
3
Detect and reject a zip bomb using overlapped entries.
Mark Adler <madler@alumni.caltech.edu>
CVE-2019-13232