Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2005-2475
Vulnerability from cvelistv5
Published
2005-08-05 04:00
Modified
2024-08-07 22:30
Severity ?
EPSS score ?
Summary
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.772Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "25098",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25098"
},
{
"name": "17653",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17653"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.info-zip.org/FAQ.html"
},
{
"name": "2005-0053",
"tags": [
"vendor-advisory",
"x_refsource_TRUSTIX",
"x_transferred"
],
"url": "http://www.trustix.org/errata/2005/0053/"
},
{
"name": "USN-191-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/usn-191-1"
},
{
"name": "18530",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/18530"
},
{
"name": "14450",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14450"
},
{
"name": "17342",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17342"
},
{
"name": "16985",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16985"
},
{
"name": "SCOSA-2005.39",
"tags": [
"vendor-advisory",
"x_refsource_SCO",
"x_transferred"
],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt"
},
{
"name": "20050801 unzip TOCTOU file-permissions vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"name": "32",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/32"
},
{
"name": "DSA-903",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"name": "RHSA-2007:0203",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"name": "17045",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17045"
},
{
"name": "17006",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17006"
},
{
"name": "16309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16309"
},
{
"name": "oval:org.mitre.oval:def:9975",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
},
{
"name": "MDKSA-2005:197",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-10T00:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "25098",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25098"
},
{
"name": "17653",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17653"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.info-zip.org/FAQ.html"
},
{
"name": "2005-0053",
"tags": [
"vendor-advisory",
"x_refsource_TRUSTIX"
],
"url": "http://www.trustix.org/errata/2005/0053/"
},
{
"name": "USN-191-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/usn-191-1"
},
{
"name": "18530",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/18530"
},
{
"name": "14450",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14450"
},
{
"name": "17342",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17342"
},
{
"name": "16985",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16985"
},
{
"name": "SCOSA-2005.39",
"tags": [
"vendor-advisory",
"x_refsource_SCO"
],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt"
},
{
"name": "20050801 unzip TOCTOU file-permissions vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"name": "32",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/32"
},
{
"name": "DSA-903",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"name": "RHSA-2007:0203",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"name": "17045",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17045"
},
{
"name": "17006",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17006"
},
{
"name": "16309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16309"
},
{
"name": "oval:org.mitre.oval:def:9975",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
},
{
"name": "MDKSA-2005:197",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2475",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "25098",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25098"
},
{
"name": "17653",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17653"
},
{
"name": "http://www.info-zip.org/FAQ.html",
"refsource": "CONFIRM",
"url": "http://www.info-zip.org/FAQ.html"
},
{
"name": "2005-0053",
"refsource": "TRUSTIX",
"url": "http://www.trustix.org/errata/2005/0053/"
},
{
"name": "USN-191-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-191-1"
},
{
"name": "18530",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/18530"
},
{
"name": "14450",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14450"
},
{
"name": "17342",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17342"
},
{
"name": "16985",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16985"
},
{
"name": "SCOSA-2005.39",
"refsource": "SCO",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt"
},
{
"name": "20050801 unzip TOCTOU file-permissions vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"name": "32",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/32"
},
{
"name": "DSA-903",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"name": "RHSA-2007:0203",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"name": "17045",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17045"
},
{
"name": "17006",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17006"
},
{
"name": "16309",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16309"
},
{
"name": "oval:org.mitre.oval:def:9975",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
},
{
"name": "MDKSA-2005:197",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2475",
"datePublished": "2005-08-05T04:00:00",
"dateReserved": "2005-08-05T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6E12425-5797-46E1-AD6E-0F6616A36A50\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.\"}, {\"lang\": \"es\", \"value\": \"Race condition en Unzip 5.52 permite que usuarios locales modifiquen permisos de ficheros arbitrarios mediante un ataque a un fichero que se est\\u00e9 descomprimiendo (cuyos permisos ser\\u00e1n cambiados por Unzip despu\\u00e9s de que la descompresi\\u00f3n se complete).\"}]",
"id": "CVE-2005-2475",
"lastModified": "2024-11-20T23:59:38.573",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:H/Au:N/C:P/I:N/A:N\", \"baseScore\": 1.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"HIGH\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 1.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2005-08-05T04:00:00.000",
"references": "[{\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/16309\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/16985\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/17006\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/17045\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/17342\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/17653\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/25098\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://securityreason.com/securityalert/32\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2005/dsa-903\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.info-zip.org/FAQ.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.osvdb.org/18530\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2007-0203.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/14450\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.trustix.org/errata/2005/0053/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ubuntu.com/usn/usn-191-1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\", \"source\": \"cve@mitre.org\"}, {\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/16309\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/16985\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/17006\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/17045\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/17342\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/17653\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/25098\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securityreason.com/securityalert/32\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2005/dsa-903\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.info-zip.org/FAQ.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.osvdb.org/18530\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2007-0203.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/14450\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.trustix.org/errata/2005/0053/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/usn-191-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vendorComments": "[{\"organization\": \"Red Hat\", \"comment\": \"Red Hat is aware of this issue and is tracking it via the following bug:\\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=164927\\n\\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\\nhttp://www.redhat.com/security/updates/classification/\\n\\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\\n\\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.\", \"lastModified\": \"2007-09-05T00:00:00\"}]",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2005-2475\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2005-08-05T04:00:00.000\",\"lastModified\":\"2024-11-20T23:59:38.573\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.\"},{\"lang\":\"es\",\"value\":\"Race condition en Unzip 5.52 permite que usuarios locales modifiquen permisos de ficheros arbitrarios mediante un ataque a un fichero que se est\u00e9 descomprimiendo (cuyos permisos ser\u00e1n cambiados por Unzip despu\u00e9s de que la descompresi\u00f3n se complete).\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:P/I:N/A:N\",\"baseScore\":1.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6E12425-5797-46E1-AD6E-0F6616A36A50\"}]}]}],\"references\":[{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/16309\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/16985\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17006\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17045\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17342\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17653\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/25098\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securityreason.com/securityalert/32\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2005/dsa-903\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.info-zip.org/FAQ.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.osvdb.org/18530\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0203.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/14450\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.trustix.org/errata/2005/0053/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/usn-191-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/16309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/16985\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17006\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17045\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17342\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17653\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/25098\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securityreason.com/securityalert/32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2005/dsa-903\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.info-zip.org/FAQ.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/18530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0203.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/14450\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.trustix.org/errata/2005/0053/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/usn-191-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Red Hat is aware of this issue and is tracking it via the following bug:\\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=164927\\n\\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\\nhttp://www.redhat.com/security/updates/classification/\\n\\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\\n\\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.\",\"lastModified\":\"2007-09-05T00:00:00\"}]}}"
}
}
RHBA-2007:0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that address various bugs are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2007:0418",
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "186570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=186570"
},
{
"category": "external",
"summary": "226749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=226749"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json"
}
],
"title": "Red Hat Bug Fix Advisory: unzip bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:33:02+00:00",
"generator": {
"date": "2024-11-22T00:33:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHBA-2007:0418",
"initial_release_date": "2007-07-11T00:00:00+00:00",
"revision_history": [
{
"date": "2007-07-11T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-06-07T15:24:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:33:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-0:5.50-35.EL3.ia64",
"product_id": "unzip-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-0:5.50-35.EL3.x86_64",
"product_id": "unzip-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-0:5.50-35.EL3.i386",
"product_id": "unzip-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.src",
"product": {
"name": "unzip-0:5.50-35.EL3.src",
"product_id": "unzip-0:5.50-35.EL3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-0:5.50-35.EL3.ppc",
"product_id": "unzip-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-0:5.50-35.EL3.s390x",
"product_id": "unzip-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-0:5.50-35.EL3.s390",
"product_id": "unzip-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2007:0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user\u0027s\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2007:0203",
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "164927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=164927"
},
{
"category": "external",
"summary": "178960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=178960"
},
{
"category": "external",
"summary": "199104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=199104"
},
{
"category": "external",
"summary": "230558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=230558"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json"
}
],
"title": "Red Hat Security Advisory: unzip security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:32:55+00:00",
"generator": {
"date": "2024-11-22T00:32:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2007:0203",
"initial_release_date": "2007-05-01T13:37:00+00:00",
"revision_history": [
{
"date": "2007-05-01T13:37:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-05-01T13:05:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:32:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.src",
"product": {
"name": "unzip-0:5.51-9.EL4.5.src",
"product_id": "unzip-0:5.51-9.EL4.5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-0:5.51-9.EL4.5.i386",
"product_id": "unzip-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390",
"product_id": "unzip-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
rhba-2007_0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that address various bugs are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2007:0418",
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "186570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=186570"
},
{
"category": "external",
"summary": "226749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=226749"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json"
}
],
"title": "Red Hat Bug Fix Advisory: unzip bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:33:02+00:00",
"generator": {
"date": "2024-11-22T00:33:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHBA-2007:0418",
"initial_release_date": "2007-07-11T00:00:00+00:00",
"revision_history": [
{
"date": "2007-07-11T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-06-07T15:24:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:33:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-0:5.50-35.EL3.ia64",
"product_id": "unzip-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-0:5.50-35.EL3.x86_64",
"product_id": "unzip-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-0:5.50-35.EL3.i386",
"product_id": "unzip-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.src",
"product": {
"name": "unzip-0:5.50-35.EL3.src",
"product_id": "unzip-0:5.50-35.EL3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-0:5.50-35.EL3.ppc",
"product_id": "unzip-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-0:5.50-35.EL3.s390x",
"product_id": "unzip-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-0:5.50-35.EL3.s390",
"product_id": "unzip-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
rhsa-2007:0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user\u0027s\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2007:0203",
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "164927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=164927"
},
{
"category": "external",
"summary": "178960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=178960"
},
{
"category": "external",
"summary": "199104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=199104"
},
{
"category": "external",
"summary": "230558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=230558"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json"
}
],
"title": "Red Hat Security Advisory: unzip security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:32:55+00:00",
"generator": {
"date": "2024-11-22T00:32:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2007:0203",
"initial_release_date": "2007-05-01T13:37:00+00:00",
"revision_history": [
{
"date": "2007-05-01T13:37:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-05-01T13:05:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:32:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.src",
"product": {
"name": "unzip-0:5.51-9.EL4.5.src",
"product_id": "unzip-0:5.51-9.EL4.5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-0:5.51-9.EL4.5.i386",
"product_id": "unzip-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390",
"product_id": "unzip-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
rhsa-2007_0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user\u0027s\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2007:0203",
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "164927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=164927"
},
{
"category": "external",
"summary": "178960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=178960"
},
{
"category": "external",
"summary": "199104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=199104"
},
{
"category": "external",
"summary": "230558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=230558"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json"
}
],
"title": "Red Hat Security Advisory: unzip security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:32:55+00:00",
"generator": {
"date": "2024-11-22T00:32:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2007:0203",
"initial_release_date": "2007-05-01T13:37:00+00:00",
"revision_history": [
{
"date": "2007-05-01T13:37:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-05-01T13:05:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:32:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 4",
"product": {
"name": "Red Hat Enterprise Linux AS version 4",
"product_id": "4AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop version 4",
"product": {
"name": "Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 4",
"product": {
"name": "Red Hat Enterprise Linux ES version 4",
"product_id": "4ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 4",
"product": {
"name": "Red Hat Enterprise Linux WS version 4",
"product_id": "4WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:4::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.src",
"product": {
"name": "unzip-0:5.51-9.EL4.5.src",
"product_id": "unzip-0:5.51-9.EL4.5.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-0:5.51-9.EL4.5.i386",
"product_id": "unzip-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-0:5.51-9.EL4.5.s390",
"product_id": "unzip-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_id": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4",
"product_id": "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4",
"product_id": "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4",
"product_id": "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.src"
},
"product_reference": "unzip-0:5.51-9.EL4.5.src",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.i386",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"relates_to_product_reference": "4WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4",
"product_id": "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"relates_to_product_reference": "4WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-05-01T13:37:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"4AS:unzip-0:5.51-9.EL4.5.i386",
"4AS:unzip-0:5.51-9.EL4.5.ia64",
"4AS:unzip-0:5.51-9.EL4.5.ppc",
"4AS:unzip-0:5.51-9.EL4.5.s390",
"4AS:unzip-0:5.51-9.EL4.5.s390x",
"4AS:unzip-0:5.51-9.EL4.5.src",
"4AS:unzip-0:5.51-9.EL4.5.x86_64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-0:5.51-9.EL4.5.src",
"4Desktop:unzip-0:5.51-9.EL4.5.x86_64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-0:5.51-9.EL4.5.i386",
"4ES:unzip-0:5.51-9.EL4.5.ia64",
"4ES:unzip-0:5.51-9.EL4.5.ppc",
"4ES:unzip-0:5.51-9.EL4.5.s390",
"4ES:unzip-0:5.51-9.EL4.5.s390x",
"4ES:unzip-0:5.51-9.EL4.5.src",
"4ES:unzip-0:5.51-9.EL4.5.x86_64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-0:5.51-9.EL4.5.i386",
"4WS:unzip-0:5.51-9.EL4.5.ia64",
"4WS:unzip-0:5.51-9.EL4.5.ppc",
"4WS:unzip-0:5.51-9.EL4.5.s390",
"4WS:unzip-0:5.51-9.EL4.5.s390x",
"4WS:unzip-0:5.51-9.EL4.5.src",
"4WS:unzip-0:5.51-9.EL4.5.x86_64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x",
"4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2007:0203"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
rhba-2007:0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated unzip packages that address various bugs are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2007:0418",
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
},
{
"category": "external",
"summary": "http://www.redhat.com/security/updates/classification/#low",
"url": "http://www.redhat.com/security/updates/classification/#low"
},
{
"category": "external",
"summary": "186570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=186570"
},
{
"category": "external",
"summary": "226749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=226749"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json"
}
],
"title": "Red Hat Bug Fix Advisory: unzip bug fix update",
"tracking": {
"current_release_date": "2024-11-22T00:33:02+00:00",
"generator": {
"date": "2024-11-22T00:33:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHBA-2007:0418",
"initial_release_date": "2007-07-11T00:00:00+00:00",
"revision_history": [
{
"date": "2007-07-11T00:00:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2007-06-07T15:24:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T00:33:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS version 3",
"product": {
"name": "Red Hat Enterprise Linux AS version 3",
"product_id": "3AS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Desktop version 3",
"product": {
"name": "Red Hat Desktop version 3",
"product_id": "3Desktop",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::desktop"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 3",
"product": {
"name": "Red Hat Enterprise Linux ES version 3",
"product_id": "3ES",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 3",
"product": {
"name": "Red Hat Enterprise Linux WS version 3",
"product_id": "3WS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:3::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ia64",
"product": {
"name": "unzip-0:5.50-35.EL3.ia64",
"product_id": "unzip-0:5.50-35.EL3.ia64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64"
}
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.x86_64",
"product": {
"name": "unzip-0:5.50-35.EL3.x86_64",
"product_id": "unzip-0:5.50-35.EL3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.i386",
"product": {
"name": "unzip-0:5.50-35.EL3.i386",
"product_id": "unzip-0:5.50-35.EL3.i386",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386"
}
}
}
],
"category": "architecture",
"name": "i386"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.src",
"product": {
"name": "unzip-0:5.50-35.EL3.src",
"product_id": "unzip-0:5.50-35.EL3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.ppc",
"product": {
"name": "unzip-0:5.50-35.EL3.ppc",
"product_id": "unzip-0:5.50-35.EL3.ppc",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc"
}
}
}
],
"category": "architecture",
"name": "ppc"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390x",
"product": {
"name": "unzip-0:5.50-35.EL3.s390x",
"product_id": "unzip-0:5.50-35.EL3.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_id": "unzip-debuginfo-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390"
}
}
},
{
"category": "product_version",
"name": "unzip-0:5.50-35.EL3.s390",
"product": {
"name": "unzip-0:5.50-35.EL3.s390",
"product_id": "unzip-0:5.50-35.EL3.s390",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390"
}
}
}
],
"category": "architecture",
"name": "s390"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3",
"product_id": "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3AS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3",
"product_id": "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3Desktop"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3",
"product_id": "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3ES"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.src"
},
"product_reference": "unzip-0:5.50-35.EL3.src",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.i386"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.i386",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ia64",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.ppc",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.s390x",
"relates_to_product_reference": "3WS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3",
"product_id": "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
},
"product_reference": "unzip-debuginfo-0:5.50-35.EL3.x86_64",
"relates_to_product_reference": "3WS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2005-2475",
"discovery_date": "2005-08-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617723"
}
],
"notes": [
{
"category": "description",
"text": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-2475"
},
{
"category": "external",
"summary": "RHBZ#1617723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-2475",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
}
],
"release_date": "2005-08-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2005-4667",
"discovery_date": "2006-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1617861"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2005-4667"
},
{
"category": "external",
"summary": "RHBZ#1617861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2005-4667",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-4667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4667"
}
],
"release_date": "2005-12-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2007-07-11T00:00:00+00:00",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"3AS:unzip-0:5.50-35.EL3.i386",
"3AS:unzip-0:5.50-35.EL3.ia64",
"3AS:unzip-0:5.50-35.EL3.ppc",
"3AS:unzip-0:5.50-35.EL3.s390",
"3AS:unzip-0:5.50-35.EL3.s390x",
"3AS:unzip-0:5.50-35.EL3.src",
"3AS:unzip-0:5.50-35.EL3.x86_64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3AS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3AS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-0:5.50-35.EL3.i386",
"3Desktop:unzip-0:5.50-35.EL3.ia64",
"3Desktop:unzip-0:5.50-35.EL3.ppc",
"3Desktop:unzip-0:5.50-35.EL3.s390",
"3Desktop:unzip-0:5.50-35.EL3.s390x",
"3Desktop:unzip-0:5.50-35.EL3.src",
"3Desktop:unzip-0:5.50-35.EL3.x86_64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3ES:unzip-0:5.50-35.EL3.i386",
"3ES:unzip-0:5.50-35.EL3.ia64",
"3ES:unzip-0:5.50-35.EL3.ppc",
"3ES:unzip-0:5.50-35.EL3.s390",
"3ES:unzip-0:5.50-35.EL3.s390x",
"3ES:unzip-0:5.50-35.EL3.src",
"3ES:unzip-0:5.50-35.EL3.x86_64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.i386",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3ES:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390",
"3ES:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64",
"3WS:unzip-0:5.50-35.EL3.i386",
"3WS:unzip-0:5.50-35.EL3.ia64",
"3WS:unzip-0:5.50-35.EL3.ppc",
"3WS:unzip-0:5.50-35.EL3.s390",
"3WS:unzip-0:5.50-35.EL3.s390x",
"3WS:unzip-0:5.50-35.EL3.src",
"3WS:unzip-0:5.50-35.EL3.x86_64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.i386",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ia64",
"3WS:unzip-debuginfo-0:5.50-35.EL3.ppc",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390",
"3WS:unzip-debuginfo-0:5.50-35.EL3.s390x",
"3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2007:0418"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
ICSA-21-308-01
Vulnerability from csaf_cisa
Published
2021-11-04 00:00
Modified
2021-11-04 00:00
Summary
VISAM VBASE Editor
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.
Critical infrastructure sectors
Multiple Sectors
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"names": [
"Michael Heinzl"
],
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Multiple Sectors",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-308-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-308-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-308-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-308-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ncas/tips/ST04-014"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "VISAM VBASE Editor",
"tracking": {
"current_release_date": "2021-11-04T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-308-01",
"initial_release_date": "2021-11-04T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-11-04T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-308-01 VISAM VBASE Editor"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "11.6.0.6",
"product": {
"name": "VBASE Pro-RT/ Server-RT (Web Remote): Version 11.6.0.6",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "VBASE Pro-RT/ Server-RT (Web Remote)"
}
],
"category": "vendor",
"name": "VISAM"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-38417",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.CVE-2021-38417has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38417"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-42535",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.CVE-2021-42535 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42535"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-42537",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"notes": [
{
"category": "summary",
"text": "The affected software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.CVE-2021-42537 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42537"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-34803",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-13699",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2019-18988",
"cwe": {
"id": "CWE-521",
"name": "Weak Password Requirements"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-16550",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-14333",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2005-2475",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
icsa-21-308-01
Vulnerability from csaf_cisa
Published
2021-11-04 00:00
Modified
2021-11-04 00:00
Summary
VISAM VBASE Editor
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.
Critical infrastructure sectors
Multiple Sectors
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"names": [
"Michael Heinzl"
],
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Multiple Sectors",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-308-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-308-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-308-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-308-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ncas/tips/ST04-014"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "VISAM VBASE Editor",
"tracking": {
"current_release_date": "2021-11-04T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-308-01",
"initial_release_date": "2021-11-04T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-11-04T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-308-01 VISAM VBASE Editor"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "11.6.0.6",
"product": {
"name": "VBASE Pro-RT/ Server-RT (Web Remote): Version 11.6.0.6",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "VBASE Pro-RT/ Server-RT (Web Remote)"
}
],
"category": "vendor",
"name": "VISAM"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-38417",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.CVE-2021-38417has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38417"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-42535",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.CVE-2021-42535 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42535"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-42537",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"notes": [
{
"category": "summary",
"text": "The affected software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.CVE-2021-42537 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42537"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-34803",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-13699",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2019-18988",
"cwe": {
"id": "CWE-521",
"name": "Weak Password Requirements"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-16550",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-14333",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2005-2475",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "summary",
"text": "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16550"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14333"
},
{
"category": "external",
"summary": "nvd.nist.gov",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/download.php"
},
{
"category": "mitigation",
"details": "For more information, please contact VISAM using the information provided on the company contact page.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.vbase.net/en/contact.php"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
gsd-2005-2475
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2005-2475",
"description": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"id": "GSD-2005-2475",
"references": [
"https://www.suse.com/security/cve/CVE-2005-2475.html",
"https://www.debian.org/security/2005/dsa-903",
"https://access.redhat.com/errata/RHBA-2007:0418",
"https://access.redhat.com/errata/RHSA-2007:0203",
"https://linux.oracle.com/cve/CVE-2005-2475.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2005-2475"
],
"details": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"id": "GSD-2005-2475",
"modified": "2023-12-13T01:20:10.780452Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2475",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "25098",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25098"
},
{
"name": "17653",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17653"
},
{
"name": "http://www.info-zip.org/FAQ.html",
"refsource": "CONFIRM",
"url": "http://www.info-zip.org/FAQ.html"
},
{
"name": "2005-0053",
"refsource": "TRUSTIX",
"url": "http://www.trustix.org/errata/2005/0053/"
},
{
"name": "USN-191-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-191-1"
},
{
"name": "18530",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/18530"
},
{
"name": "14450",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14450"
},
{
"name": "17342",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17342"
},
{
"name": "16985",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16985"
},
{
"name": "SCOSA-2005.39",
"refsource": "SCO",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt"
},
{
"name": "20050801 unzip TOCTOU file-permissions vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"name": "32",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/32"
},
{
"name": "DSA-903",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"name": "RHSA-2007:0203",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"name": "17045",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17045"
},
{
"name": "17006",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17006"
},
{
"name": "16309",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16309"
},
{
"name": "oval:org.mitre.oval:def:9975",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
},
{
"name": "MDKSA-2005:197",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2475"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "14450",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/14450"
},
{
"name": "18530",
"refsource": "OSVDB",
"tags": [],
"url": "http://www.osvdb.org/18530"
},
{
"name": "16309",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/16309"
},
{
"name": "SCOSA-2005.39",
"refsource": "SCO",
"tags": [],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt"
},
{
"name": "USN-191-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/usn-191-1"
},
{
"name": "DSA-903",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"name": "17653",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/17653"
},
{
"name": "2005-0053",
"refsource": "TRUSTIX",
"tags": [],
"url": "http://www.trustix.org/errata/2005/0053/"
},
{
"name": "17045",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/17045"
},
{
"name": "17342",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/17342"
},
{
"name": "16985",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/16985"
},
{
"name": "17006",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/17006"
},
{
"name": "RHSA-2007:0203",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"name": "25098",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/25098"
},
{
"name": "MDKSA-2005:197",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
},
{
"name": "32",
"refsource": "SREASON",
"tags": [],
"url": "http://securityreason.com/securityalert/32"
},
{
"name": "http://www.info-zip.org/FAQ.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.info-zip.org/FAQ.html"
},
{
"name": "20050801 unzip TOCTOU file-permissions vulnerability",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"name": "oval:org.mitre.oval:def:9975",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.2,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 1.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-10-11T01:30Z",
"publishedDate": "2005-08-05T04:00Z"
}
}
}
ghsa-3m3m-6r6c-8m58
Vulnerability from github
Published
2022-05-03 03:14
Modified
2022-05-03 03:14
Details
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
{
"affected": [],
"aliases": [
"CVE-2005-2475"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-08-05T04:00:00Z",
"severity": "LOW"
},
"details": "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.",
"id": "GHSA-3m3m-6r6c-8m58",
"modified": "2022-05-03T03:14:14Z",
"published": "2022-05-03T03:14:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2475"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=112300046224117\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/16309"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/16985"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17006"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17045"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17342"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17653"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25098"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/32"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2005/dsa-903"
},
{
"type": "WEB",
"url": "http://www.info-zip.org/FAQ.html"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/18530"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2007-0203.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/14450"
},
{
"type": "WEB",
"url": "http://www.trustix.org/errata/2005/0053"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-191-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.