archivers/unzip: Fix CPE_VENDOR60ba195d5c
unzip -- multiple vulnerabilitiesentered 2016-01-04
List, test, and extract compressed files from a ZIP archive
The CVE record lists the packaged version 6.0_8 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2018-1000035 | 7.8 | 2018-02-09 | A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of ser… |
| CVE-2022-0529 | 5.5 | 2022-02-09 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows… |
| CVE-2022-0530 | 5.5 | 2022-02-09 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows… |
| CVE-2018-18384 | 5.5 | 2018-10-16 | Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, beca… |
| CVE-2016-9844 | 4.0 | 2017-01-18 | Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method v… |
| CVE-2014-9913 | 4.0 | 2017-01-18 | Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compre… |
| CVE-2021-4217 | 3.3 | 2022-08-24 | A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attack… |
| CVE-2019-13232 | 3.3 | 2019-07-04 | Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue. |
Listed in VuXML, the packaged version 6.0_8 is still in the affected range; pkg audit reports it. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2014-8141 | 7.8 | 2020-01-31 | VuXML · Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the… |
| CVE-2014-8139 | 7.8 | 2020-01-31 | VuXML · Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t… |
| CVE-2014-8140 | 7.8 | 2020-01-31 | VuXML · Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in th… |
| CVE-2015-7696 | 6.8 | 2015-11-06 | VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a craf… |
| CVE-2014-9636 | 5.0 | 2015-02-06 | VuXML · unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the comp… |
| CVE-2015-7697 | 4.3 | 2015-11-06 | VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive. |
archivers/unzip: Fix CPE_VENDOR60ba195d5c
*/*: Update WWW to use HTTPS for sourceforge.net projects Homepage link is permanent redirected to its HTTPS counterpart Issue reported by repology : https://repology.org/repository/freebsd/problems Approved by: portmgr (blanket) PR: 27488806df180a9e
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
archivers: remove 'Created by' lines A big Thank You to the original contributors of these ports: * Aaron Dalton <aaron@FreeBSD.org> * Akinori MUSHA aka knu <knu@idaemons.org> * Albert Vernon <f3cun3c02@sneakemail.com> * Alex Dupre <ale@FreeBSD.org> * Alex Samorukov <samm@freebsd.org> * Alexander Kuehn <freebsd@nagilum.org> * Alexander Logvinov <ports@logvinov.com> * Alexander Zhuravlev <zaa@zaa.pp.ru> * Alexey Dokuchaev <danfe@FreeBSD.org> * Alexey Dokuchaev <danfe@regency.nsu.ru> * Anders Nordby <anders@FreeBSD.org> * Andreas Klemm <andreas@klemm.gtn.com> * Andreev Maxim * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Andrey Chernov <ache@FreeBSD.org> * Andrey Kostenko <andrey@kostenko.name> * Anes Mukhametov <anes@anes.su> * Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>) * Ayumi M <ayu@commun.jp> * Carsten Larsen <cs@innolan.dk> * Chin-San Huang <chinsan.tw@gmail.com> * Chris D. Faulhaber <jedgar@FreeBSD.org> * Chris Larsen <darth@vader.dk> * Christopher Key <cjk32@cam.ac.uk> * Cyrille Lefevre <cyrille.lefevre@laposte.net> * Dmitry Sivachenko <demon@FreeBSD.org> * Emanuel Haupt <ehaupt@FreeBSD.org> * Emanuel Haupt <ehaupt@critical.ch> * Felix Palmen <felix@palmen-it.de> * Gabor Kovesdan <gabor@FreeBSD.org> * Gea-Suan Lin (gslin@ccca.nctu.edu.tw) * Gea-Suan Lin <gslin@gslin.org> * George Reid <greid@ukug.uk.freebsd.org> * Greg Lewis <glewis@FreeBSD.org> * Hsin-Han You <hhyou@cs.nctu.edu.tw> * Hye-Shik Chang * Hye-Shik Chang <perky@FreeBSD.org> * Igor Pokrovsky <tiamat@telegraph.spb.ru> * Jaap Boender <jaapb@kerguelen.org> * Jean-Yves Lefort <jylefort@brutele.be> * Jeff Burchell <toxic@doobie.com> * Jeffrey H. Johnson <CPE1704TKS@bellsouth.net> * Jerry Hicks * Joao Carlos Mendes Luis <jonny@jonny.eng.br> * John Marino <marino@FreeBSD.org> * José García Juanino <jjuanino@gmail.com> * Juergen Lock <nox@jelal.kn-bremen.de> * Kevin Golding <ports@caomhin.org> * Konstantin Reznichenko <kot@premierbank.dp.ua> * Koop Mast <kwm@FreeBSD.org> * Kubilay Kocak <koobs@FreeBSD.org> * Lars Thegler <lth@FreeBSD.org> * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Mark Felder <feld@FreeBSD.org> * Mark Kane <mark@mkproductions.org> * Mark Pulford <mark@kyne.com.au> * Martin Matuska <mm@FreeBSD.org> * Martin Wilke <miwi@FreeBSD.org> * Matteo Cypriani <mcy@lm7.fr> * Max Khon <fjoe@FreeBSD.org> * Maxim Sobolev <sobomax@FreeBSD.org> * Melvyn Sopacua <melvyn@magemana.nl> * Miguel Mendez <flynn@energyhq.homeip.net> * Nathan Ahlstrom <nra@FreeBSD.org> * Nicola Vitale <nivit@FreeBSD.org> * Patrick Seal <patseal@hyperhost.net> * Pav Lucistnik <pav@FreeBSD.org> * Per Wigren * Philippe Casidy <pcasidy@casidy.com> * Po-Chuan Hsieh <sunpoet@FreeBSD.org> * Poul-Henning Kamp <phk@FreeBSD.org> * Radim Kolar * Radim Kolar <hsn@filez.com> * Radim Kolar <hsn@netmag.cz> * Rainer Hurling <rhurlin@gwdg.de> * Richard Gallamore <ultima@FreeBSD.org> * Roman Shterenzon <roman@xpert.com> * Ryan Steinmetz <zi@FreeBSD.org> * Sam Lawrance <boris@brooknet.com.au> * Sergey A. Osokin <osa@FreeBSD.org> * Sergey Skvortsov <skv@protey.ru> * Sir l33tname <sirl33tname@gmail.com> * Stanislav Sedov <ssedov@mbsd.msk.ru> * Stefan Esser <se@FreeBSD.org> * Steve Wills <swills@FreeBSD.org> * Steven Kreuzer <skreuzer@FreeBSD.org> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net> * Sylvio Cesar <sylvio@FreeBSD.org> * TAKATSU Tomonari <tota@FreeBSD.org> * Thierry Thomas <thierry@pompo.net> * Thomas Abthorpe <thomas@goodking.ca> * Thomas Gellekum <tg@FreeBSD.org> * Vanilla I. Shu <vanilla@FreeBSD.org> * Wen Heping <wenheping@gmail.com> * Will Andrews <andrews@technologist.com> * Yarodin <yarodin@gmail.com> * Ying-Chieh Liao <ijliao@FreeBSD.org> * Yuri Victorovich <yuri@rawbw.com> * ache * adamw * antoine@FreeBSD.org * bf <bf2006a@yahoo.com> * chinsan <chinsan.tw@gmail.com> * giffunip@asme.org * gurkan@phys.ethz.ch * iblis <iblis.dif01@nctu.edu.tw> * ijliao * jmz * kwm@FreeBSD.org * lbartoletti <lbartoletti@FreeBSD.org> * mm * ports@c0decafe.net <ports@c0decafe.net> * samm@freebsd.org * swhetzel@gmail.com * will With hat: portmgr1ced9d288a
Remove # $FreeBSD$ from Makefiles.305f148f48
Update WWW32e44ef8b1
First pass at moving manpages to share/man for category a*e9421faa0b
archives/unzip: Spell CATEGORIES correctlyb4968d13a2
Update WWW and MASTER_SITESa29f787b7a
Cleanup patches, a* categories. Rename them to follow the make makepatch naming, and regenerate them. With hat: portmgr Sponsored by: Absolight9fa9eb9ac7
- Fix trailing whitespace in pkg-descrs, categories [a-f]* Approved by: portmgr blanket1d1f878054
Fix multiple vulnerabilities. PR: 204413 (based on) Notified by: venture37@geeklan.co.uk Security: CVE-2015-7696, CVE-2015-7697 MFH: 2016Q1dc7e952bb3
- Add CPE info Approved by: portmgr blanket84a60d0446
Remove the historic option INSTALL_AS_INFOUNZIP which would install the unzip binary as info-unzip instead of unzip. Setting this options breaks ports such as java/openjdk7. This could be fixed but the submitter an I don't see a good reason why to keep this option. PR: 197750 Submitted by: amdmi3f9dda5d353
Fix patch, pass my pointy hats please. Reported by: Tomoaki AOKI <junchoon dec sakura ne jp> Approved by: sobbef8ceb11
Fix build. The merge should have been tested against an ICONV build. Submitted by: jbeich Pointy hat to: delphij MFH: 2015Q1b7d7826fc1
Apply fix for CVE-2015-1315 from Marc Deslauriers <marc.deslauriers@canonical.com>. MFH: 2015Q1 Approved by: so092361d6ae
Apply Debian patch for CVE-2014-9636 which fixes out of boundary access issue in test_compr_eb. PR: ports/197300 Submitted by: Robert Simmons <rsimmons0 gmail com> Approved by: so Security: e543c6f8-abf2-11e4-8ac7-d050992ecde8 MFH: 2015Q114d8897ca8
Add patch to fix multiple vulnerabilities. Obtained from: debian Security: d9360908-9d52-11e4-87fd-10bf48e1088e (VuXML)d4542b687c
Merge 4 unzip slave ports into archivers/unzip as non-default options It is practically impossible to use any of the unzip slave ports. This is because archivers/unzip is used by the ports infrastruction (via USES=zip, USES=zip:infozip) and each slave port conflicts with it. If you install the slave port first, then the port infrastructure can't install archivers/unzip (although if attempted, the extracts dependency might be satisfied by the slave port so it might actually work). In any case, this change: * Adds "iconv" support as an non-default option * Add a localization group that can have zero or one selection * That group contains Chinese, Korean, or Russian support * WITH_UNZIP_UNREDUCE support was removed (I'm not sure it even worked) * Makefile was simplified (several loops removed) * Removes unzip-iconv, Chinese, Korean, Russian slave ports PR: 190349 Reported by: Mikhail Rokhin Unzip overhaul: marino Approved by: maintainer (ehaupt@)69f43aff5e
Now that this port is staged and DOCS defined we can stop testing for DOCS in any install target.fd59dfeaaa
Fix packaging after MASTER port was stagedae089be069
Bring back masterdir Reported by: matthew Pointyhat to: bapt4229ae707c
The master being stage safe, the slave is also stage safe355f0908cb
Rename MAN1 to MANPAGES to avoid triggering the sanity check84e41737e0
- Quiesce portlint - Define DOCS - Support staging PR: 184366 Submitted by: Takefu <takefu@airport.fm>771b43c983
Support staging.47f12b111c
Add NO_STAGE all over the place in preparation for the staging support (cat: russian)9ab014c6ea
Add NO_STAGE all over the place in preparation for the staging support (cat: korean)6a9fcfc6bd
Add NO_STAGE all over the place in preparation for the staging support (cat: chinese)f5750c6a0e
Add NO_STAGE all over the place in preparation for the staging support (cat: archivers)b80ec3e204
- Make ports use the libc provided iconv implementation on 10-CURRENT after r254273 - Fix a bunch of ports to properly work after this - Mark converters/libiconv as IGNORE for systems with iconv in libc Reviewed by: bapt Approved by: portmgr (bapt) Discussed with: bapt, bsam (who both contributed ideas and code)642be1b81d
- Convert USE_GMAKE to USES=gmake - Change pkgconfig:build to pkgconfig since it's the same and it's bad practice. It accidentally slipped in during the original introduction - Trim header6fe706fd4b
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig while here Reviewed by: bapt, kwm821843ca06
Variable that start with _ are considered private to the defining makefile and may not be used by ports makefiles. In addition, avoid problems should the defaults ever change. Approved by: portmgr (tabthorpe)b7b9ec7a12
- Reassign to the heap at the maintainer's requestd56091fa54
Fix typos in COMMENTd5fda8cb2c
Respect STRIP (eg. if WITH_DEBUG is defined) PR: 167816 Submitted by: Jan Beich <jbeich@tormail.org>445960e818
Take maintainership1dd4b85d8b
Remove myself from MAINTAINER8549345081
- Set CONFLICTS with unzip-iconv [1] * Forget to commit on 2011-05-04 23:36:34 UTC - Bump PORTREVISION PR: ports/152006 [1] Submitted by: KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org> [1]ea7630efeb
- Add a new port: archivers/unzip-iconv as a slave port of unzip with WITH_ICONV= yes PR: ports/152006 Submitted by: KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org>914efb6129
- Set CONFLICTS with unzip-iconv upcoming as a new port PR: ports/152006 Submitted by: KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org>c7bf4cf8a9
- add LICENSE_FILE - whitespace cleanup - add CONFLICTS PR: 155926 Submitted by: Takefu <takefu@airport.fm>1900b9dc5e
- Fix distinfo Reported by: <poyopoyo@puripuri.plala.or.jp> Pointy hat to: miwid74f68b7fa
- Get Rid MD5 support With hat: portmgr (myself)65e190c0f0
- Unbreak PR: ports/154793 Submitted by: Takefu <takefu@airport.fm>5f4bd3b53d
Add optional (WITH_ICONV) patch to convert between local and OEM charsets. PR: 150699 Submitted by: KOMATSU Shinichiro <koma2@lovepeers.org>9f30b6ed73
- Unbreak PR: ports/140631 Submitted by: Denis Eremenko <moonshade@pnhz.kz> Approved by: maintainer timeout (den; 21 days)def808eb4a