According to the versions of the unzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (infinite loop) via empty bzip2 data     in a ZIP archive.(CVE-2015-7697)

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) or possibly execute arbitrary code     via a crafted password-protected ZIP archive, possibly     related to an Extra-Field size value.(CVE-2015-7696)

  - Info-ZIP UnZip 6.0 mishandles the overlapping of files     inside a ZIP container, leading to denial of service     (resource consumption), aka a 'better zip bomb'     issue.(CVE-2019-13232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the unzip package has been released.

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow exists in Info-Zip UnZip     version <= 6.00 in the processing of password-protected     archives that allows an attacker to perform a denial of     service or to possibly achieve code     execution.(CVE-2018-1000035)

  - Info-ZIP UnZip 6.0 mishandles the overlapping of files     inside a ZIP container, leading to denial of service     (resource consumption), aka a 'better zip bomb'     issue.(CVE-2019-13232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An issue has been found in unzip, a de-archiver for .zip files. While processing a password protected archive, a heap-based buffer overflow could happen, that allows an attacker to perform a denial of service or to possibly achieve code execution.

For Debian 8 'Jessie', this problem has been fixed in version 6.0-16+deb8u6.

We recommend that you upgrade your unzip packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1726 advisory.

    This advisory aggregates security fixes for the unzip SRPM in CIQ LTS 9.6. It addresses 11 CVEs:
    CVE-2022-0529, CVE-2016-9844, CVE-2019-13232, CVE-2018-1000035, CVE-2005-4667, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for unzip fixes the following issues :

  - CVE-2018-1000035: Fixed a heap-based buffer overflow in     password protected ZIP archives (bsc#1080074)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2018-1000035 - heap based buffer overflow when opening

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4672-1 advisory.

    Rene Freingruber discovered that unzip incorrectly handled certain specially crafted password protected     ZIP archives. If a user or automated system using unzip were tricked into opening a specially crafted zip     file, an attacker could exploit this to cause a crash, resulting in a denial of service.
    (CVE-2018-1000035)

    Antonio Carista discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a     user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM and Ubuntu 14.04 ESM. (CVE-2018-18384)

    It was discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a user or     automated system using unzip were tricked into opening a specially crafted zip file, an attacker could     exploit this to cause resource consumption, resulting in a denial of service. (CVE-2019-13232)

    Martin Carpenter discovered that unzip incorrectly handled certain specially crafted ZIP archives. If a     user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2014-9913)

    Alexis Vanden Eijnde discovered that unzip incorrectly handled certain specially crafted ZIP archives. If     a user or automated system using unzip were tricked into opening a specially crafted zip file, an attacker     could exploit this to cause a crash, resulting in a denial of service. This issue only affected Ubuntu     12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2016-9844)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for unzip fixes the following issues :

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074)

This non-security issue was fixed :

+- Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-15:Update update project.

This update for unzip fixes the following security issues :

CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993)

CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110)

CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111)

CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992)

CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074).

CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
135624	EulerOS Virtualization 3.0.2.2 : unzip (EulerOS-SA-2020-1462)	Nessus	Huawei Local Security Checks	2020/4/16	2021/1/6	high
121952	Photon OS 2.0: Unzip PHSA-2018-2.0-0052	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
128803	EulerOS 2.0 SP5 : unzip (EulerOS-SA-2019-1880)	Nessus	Huawei Local Security Checks	2019/9/16	2024/4/26	high
133320	Debian DLA-2082-1 : unzip security update	Nessus	Debian Local Security Checks	2020/1/30	2024/3/28	high
372963	Rocky Linux 9.6 [CIQ] Security Update: unzip Multiple Vulnerabilities (ciqsa-2026_1726)	Nessus	Rocky Linux Local Security Checks	2026/10/28	2026/10/28	high
106898	SUSE SLES11 Security Update : unzip (SUSE-SU-2018:0465-1)	Nessus	SuSE Local Security Checks	2018/2/20	2025/10/29	high
107173	Fedora 27 : unzip (2018-ab3d1d78f3)	Nessus	Fedora Local Security Checks	2018/3/7	2025/10/27	high
144337	Ubuntu 16.04 LTS / 18.04 LTS : unzip vulnerabilities (USN-4672-1)	Nessus	Ubuntu Local Security Checks	2020/12/16	2025/9/3	high
123214	openSUSE Security Update : unzip (openSUSE-2019-509)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/11	high
117902	SUSE SLED12 / SLES12 Security Update : unzip (SUSE-SU-2018:2978-1)	Nessus	SuSE Local Security Checks	2018/10/3	2022/2/17	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high