Debian Security Advisory

DLA-741-1 unzip -- LTS security update

Date Reported:

13 Dec 2016

Affected Packages:

unzip

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 847485, Bug 847486.
In Mitre's CVE dictionary: CVE-2014-9913, CVE-2016-9844.

More information:

"unzip -l" (CVE-2014-9913) and zipinfo (CVE-2016-9844) were vulnerable to buffer overflows when provided malformed or maliciously-crafted ZIP files.

For Debian 7 Wheezy, these problems have been fixed in version 6.0-8+deb7u6.

We recommend that you upgrade your unzip packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS