GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2018:2978-1

Vulnerability from csaf_suse - Published: 2018-10-02 14:30 - Updated: 2018-10-02 14:30
Summary
Security update for unzip
Severity
Moderate
Notes
Title of the patch: Security update for unzip
Description of the patch: This update for unzip fixes the following security issues: - CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993) - CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110) - CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111) - CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992) - CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074). - CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442). This non-security issue was fixed: +- Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683)
Patchnames: SUSE-SLE-DESKTOP-12-SP3-2018-2117,SUSE-SLE-SERVER-12-SP3-2018-2117
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2014-9636
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2014-9913
4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 9 products, the same list as for CVE-2014-9636
Threats
Impact moderate
CVE-2015-7696
Affected products
Recommended 9 products, the same list as for CVE-2014-9636
Threats
Impact moderate
CVE-2015-7697
Affected products
Recommended 9 products, the same list as for CVE-2014-9636
Threats
Impact moderate
CVE-2016-9844
4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 9 products, the same list as for CVE-2014-9636
Threats
Impact moderate
CVE-2018-1000035
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 9 products, the same list as for CVE-2014-9636
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/1013992 self
https://bugzilla.suse.com/1013993 self
https://bugzilla.suse.com/1080074 self
https://bugzilla.suse.com/910683 self
https://bugzilla.suse.com/914442 self
https://bugzilla.suse.com/950110 self
https://bugzilla.suse.com/950111 self
https://www.suse.com/security/cve/CVE-2014-9636/ self
https://www.suse.com/security/cve/CVE-2014-9913/ self
https://www.suse.com/security/cve/CVE-2015-7696/ self
https://www.suse.com/security/cve/CVE-2015-7697/ self
https://www.suse.com/security/cve/CVE-2016-9844/ self
https://www.suse.com/security/cve/CVE-2018-1000035/ self
https://www.suse.com/security/cve/CVE-2014-9636 external
https://bugzilla.suse.com/914442 external
https://www.suse.com/security/cve/CVE-2014-9913 external
https://bugzilla.suse.com/1013993 external
https://bugzilla.suse.com/1159417 external
https://www.suse.com/security/cve/CVE-2015-7696 external
https://bugzilla.suse.com/1159417 external
https://bugzilla.suse.com/950110 external
https://www.suse.com/security/cve/CVE-2015-7697 external
https://bugzilla.suse.com/1159417 external
https://bugzilla.suse.com/950110 external
https://bugzilla.suse.com/950111 external
https://www.suse.com/security/cve/CVE-2016-9844 external
https://bugzilla.suse.com/1013992 external
https://bugzilla.suse.com/1159417 external
https://www.suse.com/security/cve/CVE-2018-1000035 external
https://bugzilla.suse.com/1076531 external
https://bugzilla.suse.com/1080074 external
https://bugzilla.suse.com/1149684 external
https://bugzilla.suse.com/1159417 external
https://bugzilla.suse.com/1196768 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for unzip",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for unzip fixes the following security issues:\n\n- CVE-2014-9913: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013993)\n- CVE-2015-7696: Specially crafted zip files with password protection could\n  trigger a crash and lead to denial of service (bsc#950110)\n- CVE-2015-7697: Specially crafted zip files could trigger an endless loop and\n  lead to denial of service (bsc#950111)\n- CVE-2016-9844: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013992)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074).\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442).\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-DESKTOP-12-SP3-2018-2117,SUSE-SLE-SERVER-12-SP3-2018-2117",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_2978-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:2978-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20182978-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:2978-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-October/004635.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1013992",
        "url": "https://bugzilla.suse.com/1013992"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1013993",
        "url": "https://bugzilla.suse.com/1013993"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1080074",
        "url": "https://bugzilla.suse.com/1080074"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 910683",
        "url": "https://bugzilla.suse.com/910683"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 914442",
        "url": "https://bugzilla.suse.com/914442"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 950110",
        "url": "https://bugzilla.suse.com/950110"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 950111",
        "url": "https://bugzilla.suse.com/950111"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9636 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9636/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9913 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9913/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7696 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7696/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-7697 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-7697/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9844 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9844/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1000035 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1000035/"
      }
    ],
    "title": "Security update for unzip",
    "tracking": {
      "current_release_date": "2018-10-02T14:30:55Z",
      "generator": {
        "date": "2018-10-02T14:30:55Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:2978-1",
      "initial_release_date": "2018-10-02T14:30:55Z",
      "revision_history": [
        {
          "date": "2018-10-02T14:30:55Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "unzip-6.00-33.8.1.aarch64",
                "product": {
                  "name": "unzip-6.00-33.8.1.aarch64",
                  "product_id": "unzip-6.00-33.8.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "unzip-6.00-33.8.1.ppc64le",
                "product": {
                  "name": "unzip-6.00-33.8.1.ppc64le",
                  "product_id": "unzip-6.00-33.8.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "unzip-6.00-33.8.1.s390x",
                "product": {
                  "name": "unzip-6.00-33.8.1.s390x",
                  "product_id": "unzip-6.00-33.8.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "unzip-6.00-33.8.1.x86_64",
                "product": {
                  "name": "unzip-6.00-33.8.1.x86_64",
                  "product_id": "unzip-6.00-33.8.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12 SP3",
                  "product_id": "SUSE Linux Enterprise Desktop 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP3",
          "product_id": "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64"
        },
        "product_reference": "unzip-6.00-33.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64"
        },
        "product_reference": "unzip-6.00-33.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le"
        },
        "product_reference": "unzip-6.00-33.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.s390x as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x"
        },
        "product_reference": "unzip-6.00-33.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64"
        },
        "product_reference": "unzip-6.00-33.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64"
        },
        "product_reference": "unzip-6.00-33.8.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le"
        },
        "product_reference": "unzip-6.00-33.8.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x"
        },
        "product_reference": "unzip-6.00-33.8.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "unzip-6.00-33.8.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        },
        "product_reference": "unzip-6.00-33.8.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-9636",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9636"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9636",
          "url": "https://www.suse.com/security/cve/CVE-2014-9636"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 914442 for CVE-2014-9636",
          "url": "https://bugzilla.suse.com/914442"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-9636"
    },
    {
      "cve": "CVE-2014-9913",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9913"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9913",
          "url": "https://www.suse.com/security/cve/CVE-2014-9913"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1013993 for CVE-2014-9913",
          "url": "https://bugzilla.suse.com/1013993"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159417 for CVE-2014-9913",
          "url": "https://bugzilla.suse.com/1159417"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9913"
    },
    {
      "cve": "CVE-2015-7696",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7696"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7696",
          "url": "https://www.suse.com/security/cve/CVE-2015-7696"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159417 for CVE-2015-7696",
          "url": "https://bugzilla.suse.com/1159417"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 950110 for CVE-2015-7696",
          "url": "https://bugzilla.suse.com/950110"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7696"
    },
    {
      "cve": "CVE-2015-7697",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-7697"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-7697",
          "url": "https://www.suse.com/security/cve/CVE-2015-7697"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159417 for CVE-2015-7697",
          "url": "https://bugzilla.suse.com/1159417"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 950110 for CVE-2015-7697",
          "url": "https://bugzilla.suse.com/950110"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 950111 for CVE-2015-7697",
          "url": "https://bugzilla.suse.com/950111"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-7697"
    },
    {
      "cve": "CVE-2016-9844",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9844"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9844",
          "url": "https://www.suse.com/security/cve/CVE-2016-9844"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1013992 for CVE-2016-9844",
          "url": "https://bugzilla.suse.com/1013992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159417 for CVE-2016-9844",
          "url": "https://bugzilla.suse.com/1159417"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9844"
    },
    {
      "cve": "CVE-2018-1000035",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1000035"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow exists in Info-Zip UnZip version \u003c= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1000035",
          "url": "https://www.suse.com/security/cve/CVE-2018-1000035"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1076531 for CVE-2018-1000035",
          "url": "https://bugzilla.suse.com/1076531"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1080074 for CVE-2018-1000035",
          "url": "https://bugzilla.suse.com/1080074"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149684 for CVE-2018-1000035",
          "url": "https://bugzilla.suse.com/1149684"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1159417 for CVE-2018-1000035",
          "url": "https://bugzilla.suse.com/1159417"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1196768 for CVE-2018-1000035",
          "url": "https://bugzilla.suse.com/1196768"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server 12 SP3:unzip-6.00-33.8.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:unzip-6.00-33.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-02T14:30:55Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1000035"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.