CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

archivers/unzip 6.0_8

List, test, and extract compressed files from a ZIP archive

8
unaddressed
0
VuXML only
11
fixed
0
open problem reports

Port info

Maintainer
ehaupt@FreeBSD.org
Packages
latest: 6.0_8
Upstream
up to date
Last update
to 6.0_8 · 60ba195d5c
Quarterly
2026Q4: 6.0_8
Formerly
archivers/unzip-iconv until 2014-08-15, chinese/unzip until 2014-08-15, korean/unzip until 2014-08-15, russian/unzip until 2014-08-15
WWW
https://infozip.sourceforge.net/UnZip.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install unzip
installs 6.0_8 from latest; from quarterly (2026Q4) 6.0_8
Port
# cd /usr/ports/archivers/unzip && make install clean
# make -C /usr/ports/archivers/unzip config  # change options first
Size
140 KiB download · 316 KiB installed
Depends on
nothing
License
Info-ZIP
Options
1 of 5 on in the package: DOCS
Show the 4 options that are off
CHINESE ICONV KOREAN RUSSIAN

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 166.0_86.0_8–
FreeBSD 156.0_86.0_8–
FreeBSD 146.0_86.0_86.0_8

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 156.0_86.0_8–
FreeBSD 146.0_86.0_86.0_8

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (8)

The CVE record lists the packaged version 6.0_8 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2018-10000357.82018-02-09A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of ser…
CVE-2022-05295.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2022-05305.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2018-183845.52018-10-16Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, beca…
CVE-2016-98444.02017-01-18Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method v…
CVE-2014-99134.02017-01-18Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compre…
CVE-2021-42173.32022-08-24A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attack…
CVE-2019-132323.32019-07-04Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

VuXML only (0)

Listed in VuXML, the packaged version 6.0_8 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (11)

Show 11 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2014-81417.82020-01-31VuXML · Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the…
CVE-2014-81397.82020-01-31VuXML · Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t…
CVE-2014-81407.82020-01-31VuXML · Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in th…
CVE-2015-76966.82015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a craf…
CVE-2014-96365.02015-02-06VuXML · unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the comp…
CVE-2015-76974.32015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (145)

Pav Lucistnik (pav) · as korean/unzip
- Mark BROKEN: does not patch

Reported by:	pointyhat
03e239d5c3
Andrey A. Chernov (ache) · 6.0
For unknown reason bsd.port.mk's eval dislike ( and ) in the path, when MASTER_SITE_BACKUP with ${MASTER_SITES:S/%SUBDIR%/${MASTER_SITE_SUBDIR}/} at the end and MASTER_SITE_OVERRIDE ?= ${MASTER_SITE_BACKUP} are used together in /etc/make.conf.

So, use simple workaround: replace ( and ) by their URL-encoded %-codes.

(There is the bug in that area still remains, but not fatal:
the combination above don't understand properly ending :tags sometimes
and tries mass fetching with ending :tags unstripped.
Someone should look at that whole bsd.ports.mk/bsd.sites.mk mess)

While I am here, slightly rearrange ending :tags.
4da8d0e6e0
Andrey A. Chernov (ache) · 6.0
Remove -DUNICODE_WCHAR, too early
e1f251b8a5
Andrey A. Chernov (ache) · 6.0
Upgrade to 6.0

PR:             139971
d2c74b6734
Dmitry Marakasov (amdmi3) · 5.52_5
- Switch SourceForge ports to the new File Release System: categories starting with A
a07aa037a1
Andrey A. Chernov (ache) · 5.52_5
Fix missing quote in prev change

PR:             131283
Submitted by:   Dmitry <dmitry2006@yandex.ru>
5863a97569
David E. O'Brien (obrien) · 5.52_5
Set INSTALL_AS_INFOUNZIP=yes to install as ${PREFIX}/bin/info-unzip.

Approved by:	ache
73a1b25cd3
Andrey A. Chernov (ache) · 5.52_5
Switch to SF master
35258fa5bc
Pav Lucistnik (pav) · 5.52_5
- Remove duplicates from MAKE_ENV after inclusion of CC and CXX in default MAKE_ENV
29e60de039
Andrey A. Chernov (ache) · 5.52_5
Honor CC Reorganize LOCAL_UNZIP

PR:             122389
Submitted by:   Frank Fenor <frank@fenor.de> (CC part)
1ea2728b26
Andrey A. Chernov (ache) · 5.52_4
USE_UNSHRINK becomes default long time ago, remove it
2ca6e3aeb7
Andrey A. Chernov (ache) · 5.52_4
Security fixes adopted/reimplemented from Debian: CVE-2008-0888, CVE-2005-4667, CAN-2005-2475 Enable ACORN_FTYPE_NFS and WILD_STOP_AT_DIR options

PR:             122367
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
d775f2b68c
Andrey A. Chernov (ache) · 5.52_3
Make it work with files >2Gb in archives

PR:             108799
Submitted by:   "George L. Yermulnik" <yz@yz.kiev.ua>
e70954241b
Andrey A. Chernov (ache) · 5.52_2
TARGETDIR -> PREFIX
ab79508aab
Andrey A. Chernov (ache) · 5.52_2
- Respect DESTDIR - Eliminate plist

PR:             101816
Submitted by:   gabor
2dcf910727
Andrew Pantyukhin (sat) · 5.52_2
- Rid the tree of double slashes in URL paths
e48050b4a8
Edwin Groothuis (edwin) · 5.52_2
SHA256ify (manually done and checked)

Approved by:    krion@
44855e0b04
Andrey A. Chernov (ache) · 5.52_2
unzip TOCTOU file-permissions vulnerability (submitted patch slightly modified)

PR:     85920
Submitted by:   Marcus Alves Grando <marcus@corp.grupos.com.br>
c0f88731fd
Mark Linimon (linimon) · as chinese/unzip
Reset bouncing maintainer address.  These ports are now available for adoption.

Note that I have left the maintainer's own ftp site as a MASTERSITE
because it still appears to be active (for now, anyways).

Hat:	portmgr
8cf8875aef
Sergey Skvortsov (skv) · as chinese/unzip
* add CONFLICTS * make portlint happy

Approved by:	portmgr (krion)
5139be0a1c
Sergey Skvortsov (skv) · as russian/unzip
Fix CONFLICTS (again - don't blame me!):

"ch-" => "zh-"
40eecb0229
Sergey Skvortsov (skv) · as russian/unzip
Fix CONFLICTS:

[a-z][a-z]-unzip-[0-9]* is too broad regex - it's my fault :(
d8cbc287c8
Sergey Skvortsov (skv) · as russian/unzip
Add unzip , unzip with CP866 and KOI8-R support.

PR:		ports/80607
Submitted by:	den
acd6355a58
Andrey A. Chernov (ache) · 5.52_1
Upgdrade to Feb 28 version
92c2bde1ea
Andrey A. Chernov (ache) · 5.52
Upgrade to 5.52

PR:             78200
3ce5317700
Sergey Matveychuk (sem) · as chinese/unzip
- Pass maintainership to submitter

PR:		ports/75730
Submitted by:	statue(at)freebsd.netlab.cse.yzu.edu.tw
dc769a34d1
Kirill Ponomarev (krion) · 5.51
Portlint(1)
99b04635d5
Andrey A. Chernov (ache) · 5.51
Change WWW to proper one
2247a9f962
Volker Stolz (vs) · 5.51
Point WWW-tag to master-site instead of mirror.

PR:             ports/69481
Submitted by:   Tim Bishop
Apologies to:	Andrey
fe4107434d
Volker Stolz (vs) · 5.51
Quote $(CC) for better interoperability e.g. with CC="ccache gcc"

PR:		ports/66320
Submitted by:	Michael Johnson
Approved by:	maintainer timeout
3e3000cdfb
Andrey A. Chernov (ache) · 5.51
Upgrade to 5.51
138ee2adaf
Trevor Johnson (trevor) · 5.50_2
Add size data, approved by maintainers.
a1bc8c46f5
Andrey A. Chernov (ache) · 5.50_2
Fix WITH_UNZIP_UNREDUCE case

Submitted by:   nork
cf0072b606
Andrey A. Chernov (ache) · 5.50_2
Fix plist construction and silence portlint

PR:             61366
Submitted by:   Matthias Andree <matthias.andree@gmx.de>
dac13a8172
Mark Linimon (linimon) · as chinese/unzip
statue@freebsd.sinica.edu.tw has asked for all the maintained ports to be reset to ports@FreeBSD.org.  We're sorry to see you go and want to thank you for your help in the past.

PR:		ports/59515
Submitted by:	statue@freebsd.sinica.edu.tw
30b459ebc5
Kris Kennaway (kris) · 5.50_2
portlint (DISTFILES -> DISTNAME,EXTRACT_SUFX; silence possible errors from @unexec)
6b35e42570
Kris Kennaway (kris) · 5.50_2
portlint (fix whitespace)
cd526025d6
Andrey A. Chernov (ache) · 5.50_2
Fixes to make slave ports happy

PR:             58268
Submitted by:   Oliver Eikemeier <eikemeier@fillmore-labs.com>
954d44c3c8
Yen-Ming Lee (leeym) · as chinese/unzip
chinese unzip: add cnoize's patch which won't strip chinese chars.

PR:		58057
Submitted by:	Statue <statue@freebsd.sinica.edu.tw>
7c8f894085
Sergey A. Osokin (osa) · 5.50_2
Cosmetic fix: use %%DOCSDIR%% macro. No functionally changes.

Submitted by:	Oleg Karachevtsev <ok@etrust.ru>
A part of PR:	57992
ab8cf5f2db
Andrey A. Chernov (ache) · 5.50_2
Use better ../ & control vulnerability fix

Submitted by:   ITO Tsuyoshi <tsuyoshi@is.s.u-tokyo.ac.jp>
a64b51263a
Andrey A. Chernov (ache) · 5.50_1
Close vulnerability with control char between two dots. Allow 255 char in file names.
813a186866
Hye-Shik Chang (perky) · as korean/unzip
Add a port for unzip with localized patches.

Submitted by:	Eugene M. Kim <ab@astralblue.net>
8ceafdcf85
Ade Lovett (ade) · 5.50
Clear moonlight beckons. Requiem mors pacem pkg-comment, And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.
7e52725f2a
Maxim Sobolev (sobomax) · 5.50
Due to popular demant into each port which might be inserted into dependency list by bsd.port.mk insert anti foot-shooting device, which prevents infinite fork loop when the user defines corresponding USE_XXX in global make.conf, command line or environment.

Similar devices should probably be inserted into ports that might be inserted
into dependency list by others bsd.foo.mk files (bsd.ruby.mk, bsd.python.mk
and so on.)
4fe6852b8f
Andrey A. Chernov (ache) · 5.50
Upgrade to 5.50
45b9977dda
Andrey A. Chernov (ache) · 5.42
DISTDIR -> _DISTDIR
95d62e7d1a
Andrey A. Chernov (ache) · 5.42
Replace dead master sites Add WITH_UNZIP_UNREDUCE option
9917d36c4c
« newest← newerpage 2 of 3older →oldest »