unzip: improper handling of Unicode strings

[KexyBiscuit]

Affected package (and version)

unzip (2:6.0-3)

CVE ID(s)

CVE-2021-4217

Severity

Low

Other security advisory ID(s）

• https://ubuntu.com/security/CVE-2021-4217
  • https://launchpad.net/bugs/cve/CVE-2021-4217
  • https://ubuntu.com/security/notices/USN-7054-1
  • https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077
• https://security-tracker.debian.org/tracker/CVE-2021-4217
• https://access.redhat.com/security/cve/CVE-2021-4217
  • https://bugzilla.redhat.com/show_bug.cgi?id=2044583
• https://bugs.gentoo.org/show_bug.cgi?id=CVE-2021-4217
• https://www.suse.com/security/cve/CVE-2021-4217.html
  • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-4217
• GHSA-9xxw-h585-3vfj

Description/References

• A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
• CWE-476: CWE-476 - NULL Pointer Dereference
• CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (Ubuntu)

Patch(es)/Solution(s)

• https://git.launchpad.net/ubuntu/+source/unzip/commit/?h=applied/ubuntu/oracular-devel&id=5c048da9041782409ee3f320c11a6942bb857b60