CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

archivers/unzip 6.0_8

List, test, and extract compressed files from a ZIP archive

8
unaddressed
0
VuXML only
11
fixed
0
open problem reports

Port info

Maintainer
ehaupt@FreeBSD.org
Packages
latest: 6.0_8
Upstream
up to date
Last update
to 6.0_8 · 60ba195d5c
Quarterly
2026Q4: 6.0_8
Formerly
archivers/unzip-iconv until 2014-08-15, chinese/unzip until 2014-08-15, korean/unzip until 2014-08-15, russian/unzip until 2014-08-15
WWW
https://infozip.sourceforge.net/UnZip.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install unzip
installs 6.0_8 from latest; from quarterly (2026Q4) 6.0_8
Port
# cd /usr/ports/archivers/unzip && make install clean
# make -C /usr/ports/archivers/unzip config  # change options first
Size
140 KiB download · 316 KiB installed
Depends on
nothing
License
Info-ZIP
Options
1 of 5 on in the package: DOCS
Show the 4 options that are off
CHINESE ICONV KOREAN RUSSIAN

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 166.0_86.0_8–
FreeBSD 156.0_86.0_8–
FreeBSD 146.0_86.0_86.0_8

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 156.0_86.0_8–
FreeBSD 146.0_86.0_86.0_8

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (8)

The CVE record lists the packaged version 6.0_8 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2018-10000357.82018-02-09A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of ser…
CVE-2022-05295.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2022-05305.52022-02-09A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows…
CVE-2018-183845.52018-10-16Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, beca…
CVE-2016-98444.02017-01-18Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method v…
CVE-2014-99134.02017-01-18Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compre…
CVE-2021-42173.32022-08-24A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attack…
CVE-2019-132323.32019-07-04Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.

VuXML only (0)

Listed in VuXML, the packaged version 6.0_8 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (11)

Show 11 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2014-81417.82020-01-31VuXML · Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the…
CVE-2014-81397.82020-01-31VuXML · Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t…
CVE-2014-81407.82020-01-31VuXML · Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in th…
CVE-2015-76966.82015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a craf…
CVE-2014-96365.02015-02-06VuXML · unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the comp…
CVE-2015-76974.32015-11-06VuXML · Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (145)

Mario Sergio Fujikawa Ferreira (lioux) · 5.42
Add NOPORTDOCS support

PR:		28577
Submitted by:	Patrick Li <pat@databits.net>
Approved by:	maintainer (he is on vacation :)
b01f67dc8e
Andrey A. Chernov (ache) · 5.42
Add mirrors

Submitted by:	Jun Kuriyama <kuriyama@imgsrc.co.jp>
550198de48
Mario Sergio Fujikawa Ferreira (lioux) · 5.42
typo clean up police: \s -> \t
2275ee0bcf
Andrey A. Chernov (ache) · 5.42
Upgrade to 5.42
93277a0513
Will Andrews (will) · 5.41
Goodbye, YEAR2000.  Hello, 2001.

Approved by:	asami
60f2b6b7a8
Maxim Sobolev (sobomax) · 5.41
From Kato's PR: - Support CFLAGS/ARCH properly - Support NOPORTDOCS

Plus my own:
- Remove ftp://... line from the comments section of Makefile
- Adjust WWW line to be http:// instead of ftp://

PR:		18904
Submitted by:	KATO Tsuguru <tkato@prontomail.ne.jp>
37e4a0377f
Andrey A. Chernov (ache) · 5.41
Upgrade to 5.41
cc2779c415
Satoshi Asami (asami) · 5.40
Fix up PORTNAME/PORTVERSION.

PR:		17986
Submitted by:	dirk.meyer@dinoex.sub.org
6028b9f952
Michael Haro (mharo) · unzip-5.40
update with the new PORTNAME/PORTVERSION variables
59df8af48e
Kris Kennaway (kris)
Respect CC
3aaa2f02d0
Michael Haro (mharo)
FreeBSD.ORG -> FreeBSD.org

Prompted by PR:  13476, 13477
Submitted by:  KATO Tsuguru
65ab34a667
Michael Haro (mharo)
ln -> ${LN}
af5f314286
David E. O'Brien (obrien)
Change Id->FreeBSD.
2832540c9c
Tim Vanderhoek (hoek)
As threatened, enforce the "Capital, no period" rule.  Ellipses are permitted.  Note that, given current numeric motif of PW, this is done in four equally-sized commits of 393 files each.
748713c3f6
Marc G. Fournier (scrappy)
Moving WWW_SITE to DESCR file ...
85de26bbcd
Marc G. Fournier (scrappy)
More Y2K/WWW_SITE links added...
23aec755f6
Andrey A. Chernov (ache)
upgrade to 5.40
643ca4e217
Jordan K. Hubbard (jkh)
Urk, do this so it actually works.  Sorry guys.
2f474adfb2
Jordan K. Hubbard (jkh)
s/MACHINE_ARCH/ARCH/

Suggested by:	Bill Fenner
8b4c16d521
Jordan K. Hubbard (jkh)
Make this work on the ALPHA
6d8cc168a6
Jun Kuriyama (kuriyama)
cleanup.
bdfbec504e
Steve Price (steve)
Remove the empty directory too.
e8b1cc9231
Steve Price (steve)
Don't try to package manpages twice.
cb83c0fd57
Tim Vanderhoek (hoek)
Add homepage to pkg/DESCR
f2951502c6
Jordan K. Hubbard (jkh)
Unbugger WRKSRC value.
d03c5864c5
Justin M. Seger (jseger)
portlint
999cbb3ea4
Andrey A. Chernov (ache)
Upgrade to 5.3.2 Submitted by: markm
3bd19ba415
Andrey A. Chernov (ache)
Use freebsd: bulding target, faster i386 crc
b507bce77e
Andrey A. Chernov (ache)
Upgrade to 5.3.1
71be8e37a5
Andrey A. Chernov (ache)
Include junk files into binary distribution as required
b969fe3474
Andrey A. Chernov (ache)
Turn on unshrink method
4b30196e34
Andrey A. Chernov (ache)
Fix ln command
858f8ea606
Andrey A. Chernov (ache)
Add zipgrep, misc cleanup
a98901c99b
Andrey A. Chernov (ache)
Add zipgrep, misc cleanup
006db1df9a
Andrey A. Chernov (ache)
Upgrade to 5.3
1ecf20b10d
Andrey A. Chernov (ache)
mastersite/distfile changes
dbc3f2c38b
Satoshi Asami (asami)
Compress a bunch of manpages.  Remove unnecessary @ directives from PLISTs.

Note: I know that this is going to break some symlinks and/or .so
includes, I will back some of these out as I run into these during
package building.
c98cfd116d
David E. O'Brien (obrien)
CATAGORIES+= -> CATAGORIES= Reordered vars where needed.  Added MAINTAINERS where needed, many mkdir --> ${MKDIR}, install -> ${INSTALL_*}, etc.
d23a795680
Satoshi Asami (asami)
Oh my goodness!  Satoshi is finally fed up and decided to "clean up" all the COMMENTs!  No package names, no version numbers, no "this is absolutix-3.1.2" type comments that have zero information contents.

Now, without any bad examples to follow, nobody has an excuse to import
a port with those kind of comments. :)

Phew!  238 ports modified!
95137d2010
Andrey A. Chernov (ache)
Upgrade to 5.2 (official release)
ad350a399e
Satoshi Asami (asami)
The rest of the archiver Makefiles.  (I've already fixed Andrey's Makefiles before.)
4d2354a8dc
Jordan K. Hubbard (jkh)
Add CATEGORIES lines to a whole bunch of port Makefiles.  Some ports are in multiple catagories - I'll expect the various MAINTAINERS to make further adjustments (and add any KEYWORDS lines) themselves.
ac3066bf75
Jordan K. Hubbard (jkh)
Initial revision
5ca7a7ffce
Andrey A. Chernov (ache)
Cleanup.
8da3f52a94
Jordan K. Hubbard (jkh)
Jean-Marc Zucconi's unzip port. Submitted by:	jmz
b16aec7081
« newest← newerpage 3 of 3