CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

archivers/unzip 6.0_8

List, test, and extract compressed files from a ZIP archive

Maintainer
ehaupt@FreeBSD.org
Packages
latest: 6.0_8
Upstream
up to date
Last update
to 6.0_8 · 60ba195d5c
Quarterly
2026Q4: 6.0_8
Formerly
archivers/unzip-iconv until 2014-08-15, chinese/unzip until 2014-08-15, korean/unzip until 2014-08-15, russian/unzip until 2014-08-15
WWW
https://infozip.sourceforge.net/UnZip.html
Links
cgit · VuXML

Unaddressed (8)

The CVE record lists the packaged version 6.0_8 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2018-10000357.82018-02-09A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of ser…
CVE-2022-05295.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2022-05305.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2018-183845.52018-10-16Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, beca…
CVE-2016-98444.02017-01-18Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method v…
CVE-2014-99134.02017-01-18Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compre…
CVE-2021-42173.32022-08-24A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attack…
CVE-2019-132323.32019-07-04Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

VuXML only (0)

Listed in VuXML, the packaged version 6.0_8 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (11)

Show 11 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2014-81417.82020-01-31VuXML · Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the…
CVE-2014-81397.82020-01-31VuXML · Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t…
CVE-2014-81407.82020-01-31VuXML · Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in th…
CVE-2015-76966.82015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a craf…
CVE-2014-96365.02015-02-06VuXML · unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the comp…
CVE-2015-76974.32015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (145)

Bernhard Froehlich (decke) · 6.0_8
archivers/unzip: Fix CPE_VENDOR
60ba195d5c
Rodrigo Osorio (rodrigo) · 6.0_8
*/*: Update WWW to use HTTPS for sourceforge.net projects

Homepage link is permanent redirected to its HTTPS counterpart
Issue reported by repology : https://repology.org/repository/freebsd/problems

Approved by:	portmgr (blanket)
PR:		274888
06df180a9e
Stefan Eßer (se) · 6.0_8
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 6.0_8
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 6.0_8
archivers: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Albert Vernon <f3cun3c02@sneakemail.com>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Kuehn <freebsd@nagilum.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Zhuravlev <zaa@zaa.pp.ru>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@regency.nsu.ru>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Andreas Klemm <andreas@klemm.gtn.com>
  *  Andreev Maxim
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Chernov <ache@FreeBSD.org>
  *  Andrey Kostenko <andrey@kostenko.name>
  *  Anes Mukhametov <anes@anes.su>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Ayumi M <ayu@commun.jp>
  *  Carsten Larsen <cs@innolan.dk>
  *  Chin-San Huang <chinsan.tw@gmail.com>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Chris Larsen <darth@vader.dk>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Cyrille Lefevre <cyrille.lefevre@laposte.net>
  *  Dmitry Sivachenko <demon@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Felix Palmen <felix@palmen-it.de>
  *  Gabor Kovesdan <gabor@FreeBSD.org>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Greg Lewis <glewis@FreeBSD.org>
  *  Hsin-Han You <hhyou@cs.nctu.edu.tw>
  *  Hye-Shik Chang
  *  Hye-Shik Chang <perky@FreeBSD.org>
  *  Igor Pokrovsky <tiamat@telegraph.spb.ru>
  *  Jaap Boender <jaapb@kerguelen.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeff Burchell <toxic@doobie.com>
  *  Jeffrey H. Johnson <CPE1704TKS@bellsouth.net>
  *  Jerry Hicks
  *  Joao Carlos Mendes Luis <jonny@jonny.eng.br>
  *  John Marino <marino@FreeBSD.org>
  *  José García Juanino <jjuanino@gmail.com>
  *  Juergen Lock <nox@jelal.kn-bremen.de>
  *  Kevin Golding <ports@caomhin.org>
  *  Konstantin Reznichenko <kot@premierbank.dp.ua>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Kane <mark@mkproductions.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Matteo Cypriani <mcy@lm7.fr>
  *  Max Khon <fjoe@FreeBSD.org>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Melvyn Sopacua <melvyn@magemana.nl>
  *  Miguel Mendez <flynn@energyhq.homeip.net>
  *  Nathan Ahlstrom <nra@FreeBSD.org>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Patrick Seal <patseal@hyperhost.net>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Per Wigren
  *  Philippe Casidy <pcasidy@casidy.com>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Poul-Henning Kamp <phk@FreeBSD.org>
  *  Radim Kolar
  *  Radim Kolar <hsn@filez.com>
  *  Radim Kolar <hsn@netmag.cz>
  *  Rainer Hurling <rhurlin@gwdg.de>
  *  Richard Gallamore <ultima@FreeBSD.org>
  *  Roman Shterenzon <roman@xpert.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sam Lawrance <boris@brooknet.com.au>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Sir l33tname <sirl33tname@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stefan Esser <se@FreeBSD.org>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Abthorpe <thomas@goodking.ca>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Vanilla I. Shu <vanilla@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Will Andrews <andrews@technologist.com>
  *  Yarodin <yarodin@gmail.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  ache
  *  adamw
  *  antoine@FreeBSD.org
  *  bf <bf2006a@yahoo.com>
  *  chinsan <chinsan.tw@gmail.com>
  *  giffunip@asme.org
  *  gurkan@phys.ethz.ch
  *  iblis <iblis.dif01@nctu.edu.tw>
  *  ijliao
  *  jmz
  *  kwm@FreeBSD.org
  *  lbartoletti <lbartoletti@FreeBSD.org>
  *  mm
  *  ports@c0decafe.net <ports@c0decafe.net>
  *  samm@freebsd.org
  *  swhetzel@gmail.com
  *  will

With hat:	portmgr
1ced9d288a
Mathieu Arnold (mat) · 6.0_8
Remove # $FreeBSD$ from Makefiles.
305f148f48
Emanuel Haupt (ehaupt) · 6.0_8
Update WWW
32e44ef8b1
Baptiste Daroussin (bapt) · 6.0_8
First pass at moving manpages to share/man for category a*
e9421faa0b
Tobias Kortkamp (tobik) · 6.0_8
archives/unzip: Spell CATEGORIES correctly
b4968d13a2
Emanuel Haupt (ehaupt) · 6.0_7
Update WWW and MASTER_SITES
a29f787b7a
Mathieu Arnold (mat) · 6.0_7
Cleanup patches, a* categories.

Rename them to follow the make makepatch naming, and regenerate them.

With hat:	portmgr
Sponsored by:	Absolight
9fa9eb9ac7
Dmitry Marakasov (amdmi3) · 6.0_7
- Fix trailing whitespace in pkg-descrs, categories [a-f]*

Approved by:	portmgr blanket
1d1f878054
Emanuel Haupt (ehaupt) · 6.0_7
Fix multiple vulnerabilities.

PR:		204413 (based on)
Notified by:	venture37@geeklan.co.uk
Security:	CVE-2015-7696, CVE-2015-7697
MFH:		2016Q1
dc7e952bb3
Dmitry Marakasov (amdmi3) · 6.0_6
- Add CPE info

Approved by:	portmgr blanket
84a60d0446
Emanuel Haupt (ehaupt) · 6.0_6
Remove the historic option INSTALL_AS_INFOUNZIP which would install the unzip binary as info-unzip instead of unzip. Setting this options breaks ports such as java/openjdk7. This could be fixed but the submitter an I don't see a good reason why to keep this option.

PR:		197750
Submitted by:	amdmi3
f9dda5d353
Xin LI (delphij) · 6.0_5
Fix patch, pass my pointy hats please.

Reported by:	Tomoaki AOKI <junchoon dec sakura ne jp>
Approved by:	so
bbef8ceb11
Xin LI (delphij) · 6.0_5
Fix build.  The merge should have been tested against an ICONV build.

Submitted by:	jbeich
Pointy hat to:	delphij
MFH:		2015Q1
b7d7826fc1
Xin LI (delphij) · 6.0_5
Apply fix for CVE-2015-1315 from Marc Deslauriers <marc.deslauriers@canonical.com>.

MFH:		2015Q1
Approved by:	so
092361d6ae
Xin LI (delphij) · 6.0_4
Apply Debian patch for CVE-2014-9636 which fixes out of boundary access issue in test_compr_eb.

PR:		ports/197300
Submitted by:	Robert Simmons <rsimmons0 gmail com>
Approved by:	so
Security:	e543c6f8-abf2-11e4-8ac7-d050992ecde8
MFH:		2015Q1
14d8897ca8
Emanuel Haupt (ehaupt) · 6.0_3
Add patch to fix multiple vulnerabilities.

Obtained from:	debian
Security:	d9360908-9d52-11e4-87fd-10bf48e1088e (VuXML)
d4542b687c
John Marino (marino) · 6.0_2
Merge 4 unzip slave ports into archivers/unzip as non-default options

It is practically impossible to use any of the unzip slave ports.  This
is because archivers/unzip is used by the ports infrastruction (via
USES=zip, USES=zip:infozip) and each slave port conflicts with it.
If you install the slave port first, then the port infrastructure can't
install archivers/unzip (although if attempted, the extracts dependency
might be satisfied by the slave port so it might actually work).

In any case, this change:
  * Adds "iconv" support as an non-default option
  * Add a localization group that can have zero or one selection
  * That group contains Chinese, Korean, or Russian support
  * WITH_UNZIP_UNREDUCE support was removed (I'm not sure it even worked)
  * Makefile was simplified (several loops removed)
  * Removes unzip-iconv, Chinese, Korean, Russian slave ports

PR:		190349
Reported by:	Mikhail Rokhin
Unzip overhaul:	marino
Approved by:	maintainer (ehaupt@)
69f43aff5e
Emanuel Haupt (ehaupt) · 6.0_1
Now that this port is staged and DOCS defined we can stop testing for DOCS in any install target.
fd59dfeaaa
Baptiste Daroussin (bapt) · 6.0_1
Rename MAN1 to MANPAGES to avoid triggering the sanity check
84e41737e0
Emanuel Haupt (ehaupt) · 6.0_1
- Quiesce portlint - Define DOCS - Support staging

PR:		184366
Submitted by:	Takefu <takefu@airport.fm>
771b43c983
Emanuel Haupt (ehaupt) · 6.0_1
Support staging.
47f12b111c
Baptiste Daroussin (bapt) · as russian/unzip
Add NO_STAGE all over the place in preparation for the staging support (cat: russian)
9ab014c6ea
Baptiste Daroussin (bapt) · as korean/unzip
Add NO_STAGE all over the place in preparation for the staging support (cat: korean)
6a9fcfc6bd
Baptiste Daroussin (bapt) · as chinese/unzip
Add NO_STAGE all over the place in preparation for the staging support (cat: chinese)
f5750c6a0e
Baptiste Daroussin (bapt) · 6.0_1
Add NO_STAGE all over the place in preparation for the staging support (cat: archivers)
b80ec3e204
Guido Falsi (madpilot) · 6.0_1
- Make ports use the libc provided iconv implementation on 10-CURRENT   after r254273 - Fix a bunch of ports to properly work after this - Mark converters/libiconv as IGNORE for systems with iconv in libc

Reviewed by:	bapt
Approved by:	portmgr (bapt)
Discussed with:	bapt, bsam (who both contributed ideas and code)
642be1b81d
Emanuel Haupt (ehaupt) · 6.0_1
- Convert USE_GMAKE to USES=gmake - Change pkgconfig:build to pkgconfig since it's the same and it's bad practice.   It accidentally slipped in during the original introduction - Trim header
6fe706fd4b
Marcus von Appen (mva) · 6.0_1
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig while here

Reviewed by:	bapt, kwm
821843ca06
Eitan Adler (eadler) · 6.0_1
Variable that start with _ are considered private to the defining makefile and may not be used by ports makefiles. In addition, avoid problems should the defaults ever change.

Approved by:	portmgr (tabthorpe)
b7b9ec7a12
Thomas Abthorpe (tabthorpe) · as russian/unzip
- Reassign to the heap at the maintainer's request
d56091fa54
Carlo Strub (cs) · 6.0_1
Fix typos in COMMENT
d5fda8cb2c
Emanuel Haupt (ehaupt) · 6.0_1
Respect STRIP (eg. if WITH_DEBUG is defined)

PR:		167816
Submitted by:	Jan Beich <jbeich@tormail.org>
445960e818
Emanuel Haupt (ehaupt) · 6.0_1
Take maintainership
1dd4b85d8b
Andrey A. Chernov (ache) · 6.0_1
Remove myself from MAINTAINER
8549345081
TAKATSU Tomonari (tota) · 6.0_1
- Set CONFLICTS with unzip-iconv [1]   * Forget to commit on 2011-05-04 23:36:34 UTC - Bump PORTREVISION

PR:		ports/152006 [1]
Submitted by:	KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org> [1]
ea7630efeb
TAKATSU Tomonari (tota) · as archivers/unzip-iconv
- Add a new port: archivers/unzip-iconv as a slave port of unzip with 		  WITH_ICONV=	yes

PR:		ports/152006
Submitted by:	KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org>
914efb6129
TAKATSU Tomonari (tota) · as chinese/unzip
- Set CONFLICTS with unzip-iconv upcoming as a new port

PR:		ports/152006
Submitted by:	KOMATSU Shinichiro <koma2_AT_lovepeers_DOT_org>
c7bf4cf8a9
Andrey A. Chernov (ache) · 6.0
- add LICENSE_FILE - whitespace cleanup - add CONFLICTS

PR:             155926
Submitted by:   Takefu <takefu@airport.fm>
1900b9dc5e
Pav Lucistnik (pav) · 6.0
- Fix distinfo

Reported by:	<poyopoyo@puripuri.plala.or.jp>
Pointy hat to:	miwi
d74f68b7fa
Martin Wilke (miwi) · 6.0
- Get Rid MD5 support

With hat:	portmgr (myself)
65e190c0f0
Pav Lucistnik (pav) · as korean/unzip
- Unbreak

PR:		ports/154793
Submitted by:	Takefu <takefu@airport.fm>
5f4bd3b53d
Andrey A. Chernov (ache) · 6.0
Add optional (WITH_ICONV) patch to convert between local and OEM charsets.

PR:             150699
Submitted by:   KOMATSU Shinichiro <koma2@lovepeers.org>
9f30b6ed73
Pav Lucistnik (pav) · as russian/unzip
- Unbreak

PR:		ports/140631
Submitted by:	Denis Eremenko <moonshade@pnhz.kz>
Approved by:	maintainer timeout (den; 21 days)
def808eb4a