CVE-2005-4667
published 2005-12-31CVE-2005-4667: Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the…
PriorityP419low3.7CVSS 2.0
AVLACHAuNCPIPAP
EXPLOIT
EPSS
1.52%
71.7th percentile
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | unzip | < unzip 5.52-7 (bookworm) | unzip 5.52-7 (bookworm) |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| info-zip | unzip | — | — |
| unzip_project | unzip | >= 0 < 5.52-7 | 5.52-7 |
| unzip_project | unzip | >= 0 < 5.52-7 | 5.52-7 |
| unzip_project | unzip | >= 0 < 5.52-7 | 5.52-7 |
| unzip_project | unzip | >= 0 < 5.52-7 | 5.52-7 |
CVSS provenance
nvdv2.03.7LOWAV:L/AC:H/Au:N/C:P/I:P/A:P
osv3.7LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
unzip vulnerability
vendor_ubuntu·2006-02-15
CVE-2005-4667 unzip vulnerability
Title: unzip vulnerability
Summary: unzip vulnerability
A buffer overflow was discovered in the handling of file name
arguments. By tricking a user or automated system into processing a
specially crafted, excessively long file name with unzip, an attacker
could exploit this to execute arbitrary code with the user's
privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
security flaw
vendor_redhat·2005-12-19·CVSS 3.7
CVE-2005-4667 [LOW] security flaw
security flaw
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Statement: Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960
The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/
Red Hat Enterprise Linux 5 is not vulnerable to this i
Debian
CVE-2005-4667: unzip - Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to exec...
vendor_debian·2005·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667: unzip - Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to exec...
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Scope: local
bookworm: resolved (fixed in 5.52-7)
bullseye: resolved (fixed in 5.52-7)
forky: resolved (fixed in 5.52-7)
sid: resolved (fixed in 5.52-7)
trixie: resolved (fixed in 5.52-7)
GHSA
GHSA-8h2v-2p8g-f36m: Buffer overflow in UnZip 5
ghsa_unreviewed·2022-05-01
CVE-2005-4667 [LOW] CWE-119 GHSA-8h2v-2p8g-f36m: Buffer overflow in UnZip 5
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
OSV
CVE-2005-4667: Buffer overflow in UnZip 5
osv·2005-12-31·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667: Buffer overflow in UnZip 5
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
No detection rules found.
Bugzilla
CVE-2005-4667 security flaw
bugzilla·2018-08-16·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 security flaw
CVE-2005-4667 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
---
Statement:
Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960
The Red Hat Security Response Team has rated this issue as having low security impact, a future update may addres
Bugzilla
CVE-2005-4667 unzip long filename buffer overflow
bugzilla·2006-03-24·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 unzip long filename buffer overflow
CVE-2005-4667 unzip long filename buffer overflow
+++ This bug was initially created as a clone of Bug #178960 +++
unzip long filename buffer overflow
unzip is vulnerable to a filename buffer overflow vulnerability. It
may be possible to execute arbitrary code as the user running unzip.
http://www.securityfocus.com/bid/15968/info
This issue can be verified with the following command:
unzip `perl -e 'print "A" x 50000'`
This issue also affects RHEL3
This issue also affects RHEL2.1
-- Additional comment from [email protected] on 2006-03-24 08:51 EST --
Exception approved at Mar 23 RHEL Updates meeting, added to RHEL4U4Proposed.
Please clone bug for RHEL3 and 2.1.
Discussion:
This flaw has been rated as having a low severity by the Red Hat
Security Response Team. More information
Bugzilla
CVE-2005-4667 unzip long filename buffer overflow
bugzilla·2006-03-24·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 unzip long filename buffer overflow
CVE-2005-4667 unzip long filename buffer overflow
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHBA-2007-0418.html
Discussion:
Call which can be closed. Errata RHBA-2007:0418-2 delivers
unzip-5.50-35.EL3.i386.rpm
Internal Status set to 'Resolved'
Status set to: Closed by Client
This event sent from IssueTracker by yves.begrand
issue 88545
Bugzilla
unzip - CVE-2005-4667 - long file name buffer overflow
bugzilla·2006-02-07·CVSS 3.7
CVE-2005-4667 [LOW] unzip - CVE-2005-4667 - long file name buffer overflow
unzip - CVE-2005-4667 - long file name buffer overflow
Description of problem:
Bug #178961 gives a description, with a simple test, of a bug which affects
unzip. It is filed only for FC but it affects really all releases.
For FC3 binaries from FC4 updates work without any changes. Where unzip-5.51
is used a patch from unzip-5.51-13.fc4.src.rpm can be applied "as is".
With unzip-5.50, like it shows up in RHL7.3, a patched src.rpm can be found at:
ftp://ftp.harddata.com/pub/Legacy_srpms/unzip-5.50-31.hd.src.rpm
or one can update to unzip-5.51 by recompiling update FC4 sources.
Discussion:
*** This bug has been marked as a duplicate of 180159 ***
Bugzilla
CVE-2005-4667 unzip long filename buffer overflow
bugzilla·2006-02-06·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 unzip long filename buffer overflow
CVE-2005-4667 unzip long filename buffer overflow
+++ This bug was initially created as a clone of Bug #178961 +++
unzip long filename buffer overflow
unzip is vulnerable to a filename buffer overflow vulnerability. It
may be possible to execute arbitrary code as the user running unzip.
http://www.securityfocus.com/bid/15968/info
This issue can be verified with the following command:
unzip `perl -e 'print "A" x 50000'`
-- Additional comment from [email protected] on 2006-01-25 14:44 EST --
This issue also affects FC5
-- Additional comment from [email protected] on 2006-02-06 08:44 EST --
fc5 and fc4 versions are fixed (unzip-5.52-2 and unzip-5.51-13.fc4).
Discussion:
Thank you, Ivana, for the heads up on this issue!
---
*** Bug 180411 has been marked as a duplicate of this b
Bugzilla
CVE-2005-4667 unzip long filename buffer overflow
bugzilla·2006-01-25·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 unzip long filename buffer overflow
CVE-2005-4667 unzip long filename buffer overflow
unzip long filename buffer overflow
unzip is vulnerable to a filename buffer overflow vulnerability. It
may be possible to execute arbitrary code as the user running unzip.
http://www.securityfocus.com/bid/15968/info
This issue can be verified with the following command:
unzip `perl -e 'print "A" x 50000'`
This issue also affects RHEL3
This issue also affects RHEL2.1
Discussion:
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release. Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products. This request is not yet committed for inclusion
Bugzilla
CVE-2005-4667 unzip long filename buffer overflow
bugzilla·2006-01-25·CVSS 3.7
CVE-2005-4667 [LOW] CVE-2005-4667 unzip long filename buffer overflow
CVE-2005-4667 unzip long filename buffer overflow
unzip long filename buffer overflow
unzip is vulnerable to a filename buffer overflow vulnerability. It
may be possible to execute arbitrary code as the user running unzip.
http://www.securityfocus.com/bid/15968/info
This issue can be verified with the following command:
unzip `perl -e 'print "A" x 50000'`
Discussion:
This issue also affects FC5
---
fc5 and fc4 versions are fixed (unzip-5.52-2 and unzip-5.51-13.fc4).
---
What about various RHEL releases? It seems to me that the bug is present in
all of these (and really the same fix).
---
Michal,
We are tracking the RHEL issue as bug 178960. We have rated this issue as low,
which means we likely won't release an update for this package just for this fix
(we will wait for other
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0930.htmlhttp://secunia.com/advisories/25098http://www.debian.org/security/2006/dsa-1012http://www.info-zip.org/FAQ.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:050http://www.osvdb.org/22400http://www.redhat.com/support/errata/RHSA-2007-0203.htmlhttp://www.securityfocus.com/archive/1/430300/100/0/threadedhttp://www.securityfocus.com/bid/15968http://www.trustix.org/errata/2006/0006https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11252https://usn.ubuntu.com/248-1/https://usn.ubuntu.com/248-2/http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0930.htmlhttp://secunia.com/advisories/25098http://www.debian.org/security/2006/dsa-1012http://www.info-zip.org/FAQ.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:050http://www.osvdb.org/22400http://www.redhat.com/support/errata/RHSA-2007-0203.htmlhttp://www.securityfocus.com/archive/1/430300/100/0/threadedhttp://www.securityfocus.com/bid/15968http://www.trustix.org/errata/2006/0006https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11252https://usn.ubuntu.com/248-1/https://usn.ubuntu.com/248-2/
2005-12-31
Published