CVE-2021-4217
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A flaw was found in unzip due to improper handling of Unicode strings, leading to a null pointer dereference. An attacker can supply a specially crafted zip file, causing a crash or code execution.
Risk Assessment
Risk includes potential arbitrary code execution or system crash when extracting a malicious zip file.
Recommendation
Update unzip to the latest version containing the security fix.
Other vulnerabilities in unzip
See all- CVE-2022-0530Medium
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bounds write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
- CVE-2022-0529Medium
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Original NVD description (English source)
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS