Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2005-2475
Vulnerability from cvelistv5
Published
2005-08-05 04:00
Modified
2024-08-07 22:30
Severity ?
EPSS score ?
Summary
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T22:30:01.772Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "25098", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/25098", }, { name: "17653", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17653", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "http://www.info-zip.org/FAQ.html", }, { name: "2005-0053", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", "x_transferred", ], url: "http://www.trustix.org/errata/2005/0053/", }, { name: "USN-191-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "http://www.ubuntu.com/usn/usn-191-1", }, { name: "18530", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://www.osvdb.org/18530", }, { name: "14450", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/14450", }, { name: "17342", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17342", }, { name: "16985", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/16985", }, { name: "SCOSA-2005.39", tags: [ "vendor-advisory", "x_refsource_SCO", "x_transferred", ], url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { name: "20050801 unzip TOCTOU file-permissions vulnerability", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { name: "32", tags: [ "third-party-advisory", "x_refsource_SREASON", "x_transferred", ], url: "http://securityreason.com/securityalert/32", }, { name: "DSA-903", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2005/dsa-903", }, { name: "RHSA-2007:0203", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { name: "17045", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17045", }, { name: "17006", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/17006", }, { name: "16309", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/16309", }, { name: "oval:org.mitre.oval:def:9975", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { name: "MDKSA-2005:197", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2005-08-01T00:00:00", descriptions: [ { lang: "en", value: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2017-10-10T00:57:01", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "25098", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/25098", }, { name: "17653", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17653", }, { tags: [ "x_refsource_CONFIRM", ], url: "http://www.info-zip.org/FAQ.html", }, { name: "2005-0053", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", ], url: "http://www.trustix.org/errata/2005/0053/", }, { name: "USN-191-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "http://www.ubuntu.com/usn/usn-191-1", }, { name: "18530", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://www.osvdb.org/18530", }, { name: "14450", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/14450", }, { name: "17342", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17342", }, { name: "16985", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/16985", }, { name: "SCOSA-2005.39", tags: [ "vendor-advisory", "x_refsource_SCO", ], url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { name: "20050801 unzip TOCTOU file-permissions vulnerability", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { name: "32", tags: [ "third-party-advisory", "x_refsource_SREASON", ], url: "http://securityreason.com/securityalert/32", }, { name: "DSA-903", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2005/dsa-903", }, { name: "RHSA-2007:0203", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { name: "17045", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17045", }, { name: "17006", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/17006", }, { name: "16309", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/16309", }, { name: "oval:org.mitre.oval:def:9975", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { name: "MDKSA-2005:197", tags: [ "vendor-advisory", "x_refsource_MANDRIVA", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2005-2475", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "25098", refsource: "SECUNIA", url: "http://secunia.com/advisories/25098", }, { name: "17653", refsource: "SECUNIA", url: "http://secunia.com/advisories/17653", }, { name: "http://www.info-zip.org/FAQ.html", refsource: "CONFIRM", url: "http://www.info-zip.org/FAQ.html", }, { name: "2005-0053", refsource: "TRUSTIX", url: "http://www.trustix.org/errata/2005/0053/", }, { name: "USN-191-1", refsource: "UBUNTU", url: "http://www.ubuntu.com/usn/usn-191-1", }, { name: "18530", refsource: "OSVDB", url: "http://www.osvdb.org/18530", }, { name: "14450", refsource: "BID", url: "http://www.securityfocus.com/bid/14450", }, { name: "17342", refsource: "SECUNIA", url: "http://secunia.com/advisories/17342", }, { name: "16985", refsource: "SECUNIA", url: "http://secunia.com/advisories/16985", }, { name: "SCOSA-2005.39", refsource: "SCO", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { name: "20050801 unzip TOCTOU file-permissions vulnerability", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { name: "32", refsource: "SREASON", url: "http://securityreason.com/securityalert/32", }, { name: "DSA-903", refsource: "DEBIAN", url: "http://www.debian.org/security/2005/dsa-903", }, { name: "RHSA-2007:0203", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { name: "17045", refsource: "SECUNIA", url: "http://secunia.com/advisories/17045", }, { name: "17006", refsource: "SECUNIA", url: "http://secunia.com/advisories/17006", }, { name: "16309", refsource: "SECUNIA", url: "http://secunia.com/advisories/16309", }, { name: "oval:org.mitre.oval:def:9975", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { name: "MDKSA-2005:197", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2005-2475", datePublished: "2005-08-05T04:00:00", dateReserved: "2005-08-05T00:00:00", dateUpdated: "2024-08-07T22:30:01.772Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2005-2475\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2005-08-05T04:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.\"},{\"lang\":\"es\",\"value\":\"Race condition en Unzip 5.52 permite que usuarios locales modifiquen permisos de ficheros arbitrarios mediante un ataque a un fichero que se esté descomprimiendo (cuyos permisos serán cambiados por Unzip después de que la descompresión se complete).\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:P/I:N/A:N\",\"baseScore\":1.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6E12425-5797-46E1-AD6E-0F6616A36A50\"}]}]}],\"references\":[{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq&m=112300046224117&w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/16309\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/16985\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17006\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17045\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17342\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/17653\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/25098\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securityreason.com/securityalert/32\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2005/dsa-903\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.info-zip.org/FAQ.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.osvdb.org/18530\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0203.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/14450\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.trustix.org/errata/2005/0053/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/usn-191-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://marc.info/?l=bugtraq&m=112300046224117&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/16309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/16985\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17006\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17045\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17342\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/17653\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/25098\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securityreason.com/securityalert/32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2005/dsa-903\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.info-zip.org/FAQ.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2005:197\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/18530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2007-0203.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/14450\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.trustix.org/errata/2005/0053/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/usn-191-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Red Hat is aware of this issue and is tracking it via the following bug:\\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=164927\\n\\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\\nhttp://www.redhat.com/security/updates/classification/\\n\\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\\n\\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.\",\"lastModified\":\"2007-09-05T00:00:00\"}]}}", }, }
rhsa-2007:0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user's\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0203", url: "https://access.redhat.com/errata/RHSA-2007:0203", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "164927", url: "https://bugzilla.redhat.com/show_bug.cgi?id=164927", }, { category: "external", summary: "178960", url: "https://bugzilla.redhat.com/show_bug.cgi?id=178960", }, { category: "external", summary: "199104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=199104", }, { category: "external", summary: "230558", url: "https://bugzilla.redhat.com/show_bug.cgi?id=230558", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json", }, ], title: "Red Hat Security Advisory: unzip security and bug fix update", tracking: { current_release_date: "2024-11-22T00:32:55+00:00", generator: { date: "2024-11-22T00:32:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0203", initial_release_date: "2007-05-01T13:37:00+00:00", revision_history: [ { date: "2007-05-01T13:37:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-05-01T13:05:16+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:32:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ia64", product: { name: "unzip-0:5.51-9.EL4.5.ia64", product_id: "unzip-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.src", product: { name: "unzip-0:5.51-9.EL4.5.src", product_id: "unzip-0:5.51-9.EL4.5.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-0:5.51-9.EL4.5.x86_64", product_id: "unzip-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.i386", product: { name: "unzip-0:5.51-9.EL4.5.i386", product_id: "unzip-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ppc", product: { name: "unzip-0:5.51-9.EL4.5.ppc", product_id: "unzip-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390x", product: { name: "unzip-0:5.51-9.EL4.5.s390x", product_id: "unzip-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390", product: { name: "unzip-0:5.51-9.EL4.5.s390", product_id: "unzip-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
rhba-2007_0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that address various bugs are now available.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2007:0418", url: "https://access.redhat.com/errata/RHBA-2007:0418", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "186570", url: "https://bugzilla.redhat.com/show_bug.cgi?id=186570", }, { category: "external", summary: "226749", url: "https://bugzilla.redhat.com/show_bug.cgi?id=226749", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json", }, ], title: "Red Hat Bug Fix Advisory: unzip bug fix update", tracking: { current_release_date: "2024-11-22T00:33:02+00:00", generator: { date: "2024-11-22T00:33:02+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2007:0418", initial_release_date: "2007-07-11T00:00:00+00:00", revision_history: [ { date: "2007-07-11T00:00:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-07T15:24:38+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:33:02+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_id: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ia64", product: { name: "unzip-0:5.50-35.EL3.ia64", product_id: "unzip-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_id: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.x86_64", product: { name: "unzip-0:5.50-35.EL3.x86_64", product_id: "unzip-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.i386", product: { name: "unzip-debuginfo-0:5.50-35.EL3.i386", product_id: "unzip-debuginfo-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.i386", product: { name: "unzip-0:5.50-35.EL3.i386", product_id: "unzip-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.50-35.EL3.src", product: { name: "unzip-0:5.50-35.EL3.src", product_id: "unzip-0:5.50-35.EL3.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_id: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ppc", product: { name: "unzip-0:5.50-35.EL3.ppc", product_id: "unzip-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390x", product: { name: "unzip-0:5.50-35.EL3.s390x", product_id: "unzip-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390", product: { name: "unzip-0:5.50-35.EL3.s390", product_id: "unzip-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
RHBA-2007:0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that address various bugs are now available.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2007:0418", url: "https://access.redhat.com/errata/RHBA-2007:0418", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "186570", url: "https://bugzilla.redhat.com/show_bug.cgi?id=186570", }, { category: "external", summary: "226749", url: "https://bugzilla.redhat.com/show_bug.cgi?id=226749", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json", }, ], title: "Red Hat Bug Fix Advisory: unzip bug fix update", tracking: { current_release_date: "2024-11-22T00:33:02+00:00", generator: { date: "2024-11-22T00:33:02+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2007:0418", initial_release_date: "2007-07-11T00:00:00+00:00", revision_history: [ { date: "2007-07-11T00:00:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-07T15:24:38+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:33:02+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_id: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ia64", product: { name: "unzip-0:5.50-35.EL3.ia64", product_id: "unzip-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_id: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.x86_64", product: { name: "unzip-0:5.50-35.EL3.x86_64", product_id: "unzip-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.i386", product: { name: "unzip-debuginfo-0:5.50-35.EL3.i386", product_id: "unzip-debuginfo-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.i386", product: { name: "unzip-0:5.50-35.EL3.i386", product_id: "unzip-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.50-35.EL3.src", product: { name: "unzip-0:5.50-35.EL3.src", product_id: "unzip-0:5.50-35.EL3.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_id: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ppc", product: { name: "unzip-0:5.50-35.EL3.ppc", product_id: "unzip-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390x", product: { name: "unzip-0:5.50-35.EL3.s390x", product_id: "unzip-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390", product: { name: "unzip-0:5.50-35.EL3.s390", product_id: "unzip-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
RHSA-2007:0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user's\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0203", url: "https://access.redhat.com/errata/RHSA-2007:0203", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "164927", url: "https://bugzilla.redhat.com/show_bug.cgi?id=164927", }, { category: "external", summary: "178960", url: "https://bugzilla.redhat.com/show_bug.cgi?id=178960", }, { category: "external", summary: "199104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=199104", }, { category: "external", summary: "230558", url: "https://bugzilla.redhat.com/show_bug.cgi?id=230558", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json", }, ], title: "Red Hat Security Advisory: unzip security and bug fix update", tracking: { current_release_date: "2024-11-22T00:32:55+00:00", generator: { date: "2024-11-22T00:32:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0203", initial_release_date: "2007-05-01T13:37:00+00:00", revision_history: [ { date: "2007-05-01T13:37:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-05-01T13:05:16+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:32:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ia64", product: { name: "unzip-0:5.51-9.EL4.5.ia64", product_id: "unzip-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.src", product: { name: "unzip-0:5.51-9.EL4.5.src", product_id: "unzip-0:5.51-9.EL4.5.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-0:5.51-9.EL4.5.x86_64", product_id: "unzip-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.i386", product: { name: "unzip-0:5.51-9.EL4.5.i386", product_id: "unzip-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ppc", product: { name: "unzip-0:5.51-9.EL4.5.ppc", product_id: "unzip-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390x", product: { name: "unzip-0:5.51-9.EL4.5.s390x", product_id: "unzip-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390", product: { name: "unzip-0:5.51-9.EL4.5.s390", product_id: "unzip-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
rhsa-2007_0203
Vulnerability from csaf_redhat
Published
2007-05-01 13:37
Modified
2024-11-22 00:32
Summary
Red Hat Security Advisory: unzip security and bug fix update
Notes
Topic
Updated unzip packages that fix two security issues and various bugs are
now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
Details
The unzip utility is used to list, test, or extract files from a zip archive.
A race condition was found in Unzip. Local users could use this flaw to
modify permissions of arbitrary files via a hard link attack on a file
while it was being decompressed (CVE-2005-2475)
A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long
file name, an attacker could execute arbitrary code with that user's
privileges. (CVE-2005-4667)
As well, this update adds support for files larger than 2GB.
All users of unzip should upgrade to these updated packages, which
contain backported patches that resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that fix two security issues and various bugs are\nnow available.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip archive.\n\nA race condition was found in Unzip. Local users could use this flaw to\nmodify permissions of arbitrary files via a hard link attack on a file\nwhile it was being decompressed (CVE-2005-2475)\n\nA buffer overflow was found in Unzip command line argument handling.\nIf a user could be tricked into running Unzip with a specially crafted long\nfile name, an attacker could execute arbitrary code with that user's\nprivileges. (CVE-2005-4667)\n\nAs well, this update adds support for files larger than 2GB.\n\nAll users of unzip should upgrade to these updated packages, which\ncontain backported patches that resolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2007:0203", url: "https://access.redhat.com/errata/RHSA-2007:0203", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "164927", url: "https://bugzilla.redhat.com/show_bug.cgi?id=164927", }, { category: "external", summary: "178960", url: "https://bugzilla.redhat.com/show_bug.cgi?id=178960", }, { category: "external", summary: "199104", url: "https://bugzilla.redhat.com/show_bug.cgi?id=199104", }, { category: "external", summary: "230558", url: "https://bugzilla.redhat.com/show_bug.cgi?id=230558", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0203.json", }, ], title: "Red Hat Security Advisory: unzip security and bug fix update", tracking: { current_release_date: "2024-11-22T00:32:55+00:00", generator: { date: "2024-11-22T00:32:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2007:0203", initial_release_date: "2007-05-01T13:37:00+00:00", revision_history: [ { date: "2007-05-01T13:37:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-05-01T13:05:16+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:32:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 4", product: { name: "Red Hat Enterprise Linux AS version 4", product_id: "4AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::as", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux Desktop version 4", product: { name: "Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 4", product: { name: "Red Hat Enterprise Linux ES version 4", product_id: "4ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 4", product: { name: "Red Hat Enterprise Linux WS version 4", product_id: "4WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:4::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ia64", product: { name: "unzip-0:5.51-9.EL4.5.ia64", product_id: "unzip-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ia64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.src", product: { name: "unzip-0:5.51-9.EL4.5.src", product_id: "unzip-0:5.51-9.EL4.5.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-0:5.51-9.EL4.5.x86_64", product_id: "unzip-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.i386", product: { name: "unzip-0:5.51-9.EL4.5.i386", product_id: "unzip-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=i386", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.ppc", product: { name: "unzip-0:5.51-9.EL4.5.ppc", product_id: "unzip-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=ppc", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390x", product: { name: "unzip-0:5.51-9.EL4.5.s390x", product_id: "unzip-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390x", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-0:5.51-9.EL4.5.s390", product: { name: "unzip-0:5.51-9.EL4.5.s390", product_id: "unzip-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.51-9.EL4.5?arch=s390", }, }, }, { category: "product_version", name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_id: "unzip-debuginfo-0:5.51-9.EL4.5.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.51-9.EL4.5?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux AS version 4", product_id: "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux Desktop version 4", product_id: "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux ES version 4", product_id: "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.src as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.src", }, product_reference: "unzip-0:5.51-9.EL4.5.src", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.i386 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.i386", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ia64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ia64", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.ppc as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.ppc", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.s390x as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.s390x", relates_to_product_reference: "4WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64 as a component of Red Hat Enterprise Linux WS version 4", product_id: "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", }, product_reference: "unzip-debuginfo-0:5.51-9.EL4.5.x86_64", relates_to_product_reference: "4WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-05-01T13:37:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "4AS:unzip-0:5.51-9.EL4.5.i386", "4AS:unzip-0:5.51-9.EL4.5.ia64", "4AS:unzip-0:5.51-9.EL4.5.ppc", "4AS:unzip-0:5.51-9.EL4.5.s390", "4AS:unzip-0:5.51-9.EL4.5.s390x", "4AS:unzip-0:5.51-9.EL4.5.src", "4AS:unzip-0:5.51-9.EL4.5.x86_64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4AS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-0:5.51-9.EL4.5.i386", "4Desktop:unzip-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-0:5.51-9.EL4.5.s390", "4Desktop:unzip-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-0:5.51-9.EL4.5.src", "4Desktop:unzip-0:5.51-9.EL4.5.x86_64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4Desktop:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4ES:unzip-0:5.51-9.EL4.5.i386", "4ES:unzip-0:5.51-9.EL4.5.ia64", "4ES:unzip-0:5.51-9.EL4.5.ppc", "4ES:unzip-0:5.51-9.EL4.5.s390", "4ES:unzip-0:5.51-9.EL4.5.s390x", "4ES:unzip-0:5.51-9.EL4.5.src", "4ES:unzip-0:5.51-9.EL4.5.x86_64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4ES:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", "4WS:unzip-0:5.51-9.EL4.5.i386", "4WS:unzip-0:5.51-9.EL4.5.ia64", "4WS:unzip-0:5.51-9.EL4.5.ppc", "4WS:unzip-0:5.51-9.EL4.5.s390", "4WS:unzip-0:5.51-9.EL4.5.s390x", "4WS:unzip-0:5.51-9.EL4.5.src", "4WS:unzip-0:5.51-9.EL4.5.x86_64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.i386", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ia64", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.ppc", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.s390x", "4WS:unzip-debuginfo-0:5.51-9.EL4.5.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2007:0203", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
rhba-2007:0418
Vulnerability from csaf_redhat
Published
2007-07-11 00:00
Modified
2024-11-22 00:33
Summary
Red Hat Bug Fix Advisory: unzip bug fix update
Notes
Topic
Updated unzip packages that address various bugs are now available.
Details
The unzip utility is used to list, test, or extract files from a zip
archive.
This update addresses the following issues:
* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)
* a long filename buffer overflow vulnerability (CVE-2005-4667)
All users of unzip should upgrade to these updated packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated unzip packages that address various bugs are now available.", title: "Topic", }, { category: "general", text: "The unzip utility is used to list, test, or extract files from a zip\narchive. \n\nThis update addresses the following issues:\n\n* a TOCTOU bug that could be exploited to change file permissions (CVE-2005-2475)\n\n* a long filename buffer overflow vulnerability (CVE-2005-4667)\n\nAll users of unzip should upgrade to these updated packages, which\nresolve these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2007:0418", url: "https://access.redhat.com/errata/RHBA-2007:0418", }, { category: "external", summary: "http://www.redhat.com/security/updates/classification/#low", url: "http://www.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "186570", url: "https://bugzilla.redhat.com/show_bug.cgi?id=186570", }, { category: "external", summary: "226749", url: "https://bugzilla.redhat.com/show_bug.cgi?id=226749", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhba-2007_0418.json", }, ], title: "Red Hat Bug Fix Advisory: unzip bug fix update", tracking: { current_release_date: "2024-11-22T00:33:02+00:00", generator: { date: "2024-11-22T00:33:02+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2007:0418", initial_release_date: "2007-07-11T00:00:00+00:00", revision_history: [ { date: "2007-07-11T00:00:00+00:00", number: "1", summary: "Initial version", }, { date: "2007-06-07T15:24:38+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T00:33:02+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_id: "unzip-debuginfo-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ia64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ia64", product: { name: "unzip-0:5.50-35.EL3.ia64", product_id: "unzip-0:5.50-35.EL3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_id: "unzip-debuginfo-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=x86_64", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.x86_64", product: { name: "unzip-0:5.50-35.EL3.x86_64", product_id: "unzip-0:5.50-35.EL3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.i386", product: { name: "unzip-debuginfo-0:5.50-35.EL3.i386", product_id: "unzip-debuginfo-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=i386", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.i386", product: { name: "unzip-0:5.50-35.EL3.i386", product_id: "unzip-0:5.50-35.EL3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "unzip-0:5.50-35.EL3.src", product: { name: "unzip-0:5.50-35.EL3.src", product_id: "unzip-0:5.50-35.EL3.src", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_id: "unzip-debuginfo-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=ppc", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.ppc", product: { name: "unzip-0:5.50-35.EL3.ppc", product_id: "unzip-0:5.50-35.EL3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390x", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390x", product: { name: "unzip-0:5.50-35.EL3.s390x", product_id: "unzip-0:5.50-35.EL3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-debuginfo-0:5.50-35.EL3.s390", product: { name: "unzip-debuginfo-0:5.50-35.EL3.s390", product_id: "unzip-debuginfo-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip-debuginfo@5.50-35.EL3?arch=s390", }, }, }, { category: "product_version", name: "unzip-0:5.50-35.EL3.s390", product: { name: "unzip-0:5.50-35.EL3.s390", product_id: "unzip-0:5.50-35.EL3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/unzip@5.50-35.EL3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.i386", }, product_reference: "unzip-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ia64", }, product_reference: "unzip-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.ppc", }, product_reference: "unzip-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390", }, product_reference: "unzip-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.s390x", }, product_reference: "unzip-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.src", }, product_reference: "unzip-0:5.50-35.EL3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "unzip-debuginfo-0:5.50-35.EL3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", }, product_reference: "unzip-debuginfo-0:5.50-35.EL3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", discovery_date: "2005-08-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617723", }, ], notes: [ { category: "description", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "RHBZ#1617723", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617723", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-2475", url: "https://www.cve.org/CVERecord?id=CVE-2005-2475", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, ], release_date: "2005-08-02T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2005-4667", discovery_date: "2006-01-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617861", }, ], notes: [ { category: "description", text: "Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178960\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", title: "Statement", }, ], product_status: { fixed: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-4667", }, { category: "external", summary: "RHBZ#1617861", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617861", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-4667", url: "https://www.cve.org/CVERecord?id=CVE-2005-4667", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-4667", }, ], release_date: "2005-12-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2007-07-11T00:00:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/", product_ids: [ "3AS:unzip-0:5.50-35.EL3.i386", "3AS:unzip-0:5.50-35.EL3.ia64", "3AS:unzip-0:5.50-35.EL3.ppc", "3AS:unzip-0:5.50-35.EL3.s390", "3AS:unzip-0:5.50-35.EL3.s390x", "3AS:unzip-0:5.50-35.EL3.src", "3AS:unzip-0:5.50-35.EL3.x86_64", "3AS:unzip-debuginfo-0:5.50-35.EL3.i386", "3AS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3AS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390", "3AS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3AS:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3Desktop:unzip-0:5.50-35.EL3.i386", "3Desktop:unzip-0:5.50-35.EL3.ia64", "3Desktop:unzip-0:5.50-35.EL3.ppc", "3Desktop:unzip-0:5.50-35.EL3.s390", "3Desktop:unzip-0:5.50-35.EL3.s390x", "3Desktop:unzip-0:5.50-35.EL3.src", "3Desktop:unzip-0:5.50-35.EL3.x86_64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.i386", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ia64", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.ppc", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.s390x", "3Desktop:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3ES:unzip-0:5.50-35.EL3.i386", "3ES:unzip-0:5.50-35.EL3.ia64", "3ES:unzip-0:5.50-35.EL3.ppc", "3ES:unzip-0:5.50-35.EL3.s390", "3ES:unzip-0:5.50-35.EL3.s390x", "3ES:unzip-0:5.50-35.EL3.src", "3ES:unzip-0:5.50-35.EL3.x86_64", "3ES:unzip-debuginfo-0:5.50-35.EL3.i386", "3ES:unzip-debuginfo-0:5.50-35.EL3.ia64", "3ES:unzip-debuginfo-0:5.50-35.EL3.ppc", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390", "3ES:unzip-debuginfo-0:5.50-35.EL3.s390x", "3ES:unzip-debuginfo-0:5.50-35.EL3.x86_64", "3WS:unzip-0:5.50-35.EL3.i386", "3WS:unzip-0:5.50-35.EL3.ia64", "3WS:unzip-0:5.50-35.EL3.ppc", "3WS:unzip-0:5.50-35.EL3.s390", "3WS:unzip-0:5.50-35.EL3.s390x", "3WS:unzip-0:5.50-35.EL3.src", "3WS:unzip-0:5.50-35.EL3.x86_64", "3WS:unzip-debuginfo-0:5.50-35.EL3.i386", "3WS:unzip-debuginfo-0:5.50-35.EL3.ia64", "3WS:unzip-debuginfo-0:5.50-35.EL3.ppc", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390", "3WS:unzip-debuginfo-0:5.50-35.EL3.s390x", "3WS:unzip-debuginfo-0:5.50-35.EL3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2007:0418", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, ], }
gsd-2005-2475
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Aliases
Aliases
{ GSD: { alias: "CVE-2005-2475", description: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", id: "GSD-2005-2475", references: [ "https://www.suse.com/security/cve/CVE-2005-2475.html", "https://www.debian.org/security/2005/dsa-903", "https://access.redhat.com/errata/RHBA-2007:0418", "https://access.redhat.com/errata/RHSA-2007:0203", "https://linux.oracle.com/cve/CVE-2005-2475.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2005-2475", ], details: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", id: "GSD-2005-2475", modified: "2023-12-13T01:20:10.780452Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2005-2475", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "25098", refsource: "SECUNIA", url: "http://secunia.com/advisories/25098", }, { name: "17653", refsource: "SECUNIA", url: "http://secunia.com/advisories/17653", }, { name: "http://www.info-zip.org/FAQ.html", refsource: "CONFIRM", url: "http://www.info-zip.org/FAQ.html", }, { name: "2005-0053", refsource: "TRUSTIX", url: "http://www.trustix.org/errata/2005/0053/", }, { name: "USN-191-1", refsource: "UBUNTU", url: "http://www.ubuntu.com/usn/usn-191-1", }, { name: "18530", refsource: "OSVDB", url: "http://www.osvdb.org/18530", }, { name: "14450", refsource: "BID", url: "http://www.securityfocus.com/bid/14450", }, { name: "17342", refsource: "SECUNIA", url: "http://secunia.com/advisories/17342", }, { name: "16985", refsource: "SECUNIA", url: "http://secunia.com/advisories/16985", }, { name: "SCOSA-2005.39", refsource: "SCO", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { name: "20050801 unzip TOCTOU file-permissions vulnerability", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { name: "32", refsource: "SREASON", url: "http://securityreason.com/securityalert/32", }, { name: "DSA-903", refsource: "DEBIAN", url: "http://www.debian.org/security/2005/dsa-903", }, { name: "RHSA-2007:0203", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { name: "17045", refsource: "SECUNIA", url: "http://secunia.com/advisories/17045", }, { name: "17006", refsource: "SECUNIA", url: "http://secunia.com/advisories/17006", }, { name: "16309", refsource: "SECUNIA", url: "http://secunia.com/advisories/16309", }, { name: "oval:org.mitre.oval:def:9975", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { name: "MDKSA-2005:197", refsource: "MANDRIVA", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2005-2475", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "NVD-CWE-Other", }, ], }, ], }, references: { reference_data: [ { name: "14450", refsource: "BID", tags: [], url: "http://www.securityfocus.com/bid/14450", }, { name: "18530", refsource: "OSVDB", tags: [], url: "http://www.osvdb.org/18530", }, { name: "16309", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/16309", }, { name: "SCOSA-2005.39", refsource: "SCO", tags: [], url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { name: "USN-191-1", refsource: "UBUNTU", tags: [], url: "http://www.ubuntu.com/usn/usn-191-1", }, { name: "DSA-903", refsource: "DEBIAN", tags: [], url: "http://www.debian.org/security/2005/dsa-903", }, { name: "17653", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/17653", }, { name: "2005-0053", refsource: "TRUSTIX", tags: [], url: "http://www.trustix.org/errata/2005/0053/", }, { name: "17045", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/17045", }, { name: "17342", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/17342", }, { name: "16985", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/16985", }, { name: "17006", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/17006", }, { name: "RHSA-2007:0203", refsource: "REDHAT", tags: [], url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { name: "25098", refsource: "SECUNIA", tags: [], url: "http://secunia.com/advisories/25098", }, { name: "MDKSA-2005:197", refsource: "MANDRIVA", tags: [], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, { name: "32", refsource: "SREASON", tags: [], url: "http://securityreason.com/securityalert/32", }, { name: "http://www.info-zip.org/FAQ.html", refsource: "CONFIRM", tags: [], url: "http://www.info-zip.org/FAQ.html", }, { name: "20050801 unzip TOCTOU file-permissions vulnerability", refsource: "BUGTRAQ", tags: [], url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { name: "oval:org.mitre.oval:def:9975", refsource: "OVAL", tags: [], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "HIGH", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "NONE", baseScore: 1.2, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:L/AC:H/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 1.9, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "LOW", userInteractionRequired: false, }, }, lastModifiedDate: "2017-10-11T01:30Z", publishedDate: "2005-08-05T04:00Z", }, }, }
opensuse-su-2024:11485-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
unzip-6.00-39.1 on GA media
Notes
Title of the patch
unzip-6.00-39.1 on GA media
Description of the patch
These are all security issues fixed in the unzip-6.00-39.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11485
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "unzip-6.00-39.1 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the unzip-6.00-39.1 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-11485", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11485-1.json", }, { category: "self", summary: "SUSE CVE CVE-2005-2475 page", url: "https://www.suse.com/security/cve/CVE-2005-2475/", }, { category: "self", summary: "SUSE CVE CVE-2014-9636 page", url: "https://www.suse.com/security/cve/CVE-2014-9636/", }, { category: "self", summary: "SUSE CVE CVE-2016-9844 page", url: "https://www.suse.com/security/cve/CVE-2016-9844/", }, { category: "self", summary: "SUSE CVE CVE-2018-1000035 page", url: "https://www.suse.com/security/cve/CVE-2018-1000035/", }, { category: "self", summary: "SUSE CVE CVE-2018-18384 page", url: "https://www.suse.com/security/cve/CVE-2018-18384/", }, ], title: "unzip-6.00-39.1 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:11485-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "unzip-6.00-39.1.aarch64", product: { name: "unzip-6.00-39.1.aarch64", product_id: "unzip-6.00-39.1.aarch64", }, }, { category: "product_version", name: "unzip-doc-6.00-39.1.aarch64", product: { name: "unzip-doc-6.00-39.1.aarch64", product_id: "unzip-doc-6.00-39.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "unzip-6.00-39.1.ppc64le", product: { name: "unzip-6.00-39.1.ppc64le", product_id: "unzip-6.00-39.1.ppc64le", }, }, { category: "product_version", name: "unzip-doc-6.00-39.1.ppc64le", product: { name: "unzip-doc-6.00-39.1.ppc64le", product_id: "unzip-doc-6.00-39.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "unzip-6.00-39.1.s390x", product: { name: "unzip-6.00-39.1.s390x", product_id: "unzip-6.00-39.1.s390x", }, }, { category: "product_version", name: "unzip-doc-6.00-39.1.s390x", product: { name: "unzip-doc-6.00-39.1.s390x", product_id: "unzip-doc-6.00-39.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "unzip-6.00-39.1.x86_64", product: { name: "unzip-6.00-39.1.x86_64", product_id: "unzip-6.00-39.1.x86_64", }, }, { category: "product_version", name: "unzip-doc-6.00-39.1.x86_64", product: { name: "unzip-doc-6.00-39.1.x86_64", product_id: "unzip-doc-6.00-39.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "unzip-6.00-39.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", }, product_reference: "unzip-6.00-39.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-6.00-39.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", }, product_reference: "unzip-6.00-39.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-6.00-39.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", }, product_reference: "unzip-6.00-39.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-6.00-39.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", }, product_reference: "unzip-6.00-39.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-doc-6.00-39.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", }, product_reference: "unzip-doc-6.00-39.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-doc-6.00-39.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", }, product_reference: "unzip-doc-6.00-39.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-doc-6.00-39.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", }, product_reference: "unzip-doc-6.00-39.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "unzip-doc-6.00-39.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", }, product_reference: "unzip-doc-6.00-39.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2005-2475", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2005-2475", }, ], notes: [ { category: "general", text: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2005-2475", url: "https://www.suse.com/security/cve/CVE-2005-2475", }, { category: "external", summary: "SUSE Bug 274156 for CVE-2005-2475", url: "https://bugzilla.suse.com/274156", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2005-2475", }, { cve: "CVE-2014-9636", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-9636", }, ], notes: [ { category: "general", text: "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-9636", url: "https://www.suse.com/security/cve/CVE-2014-9636", }, { category: "external", summary: "SUSE Bug 914442 for CVE-2014-9636", url: "https://bugzilla.suse.com/914442", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2014-9636", }, { cve: "CVE-2016-9844", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-9844", }, ], notes: [ { category: "general", text: "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-9844", url: "https://www.suse.com/security/cve/CVE-2016-9844", }, { category: "external", summary: "SUSE Bug 1013992 for CVE-2016-9844", url: "https://bugzilla.suse.com/1013992", }, { category: "external", summary: "SUSE Bug 1159417 for CVE-2016-9844", url: "https://bugzilla.suse.com/1159417", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2016-9844", }, { cve: "CVE-2018-1000035", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-1000035", }, ], notes: [ { category: "general", text: "A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-1000035", url: "https://www.suse.com/security/cve/CVE-2018-1000035", }, { category: "external", summary: "SUSE Bug 1076531 for CVE-2018-1000035", url: "https://bugzilla.suse.com/1076531", }, { category: "external", summary: "SUSE Bug 1080074 for CVE-2018-1000035", url: "https://bugzilla.suse.com/1080074", }, { category: "external", summary: "SUSE Bug 1149684 for CVE-2018-1000035", url: "https://bugzilla.suse.com/1149684", }, { category: "external", summary: "SUSE Bug 1159417 for CVE-2018-1000035", url: "https://bugzilla.suse.com/1159417", }, { category: "external", summary: "SUSE Bug 1196768 for CVE-2018-1000035", url: "https://bugzilla.suse.com/1196768", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2018-1000035", }, { cve: "CVE-2018-18384", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-18384", }, ], notes: [ { category: "general", text: "Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-18384", url: "https://www.suse.com/security/cve/CVE-2018-18384", }, { category: "external", summary: "SUSE Bug 1110194 for CVE-2018-18384", url: "https://bugzilla.suse.com/1110194", }, { category: "external", summary: "SUSE Bug 1148898 for CVE-2018-18384", url: "https://bugzilla.suse.com/1148898", }, { category: "external", summary: "SUSE Bug 1153715 for CVE-2018-18384", url: "https://bugzilla.suse.com/1153715", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.3, baseSeverity: "LOW", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:unzip-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-6.00-39.1.x86_64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.aarch64", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.ppc64le", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.s390x", "openSUSE Tumbleweed:unzip-doc-6.00-39.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2018-18384", }, ], }
ICSA-21-308-01
Vulnerability from csaf_cisa
Published
2021-11-04 00:00
Modified
2021-11-04 00:00
Summary
VISAM VBASE Editor
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.
Critical infrastructure sectors
Multiple Sectors
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Exploitability
No known public exploits specifically target these vulnerabilities.
{ document: { acknowledgments: [ { names: [ "Michael Heinzl", ], summary: "reporting these vulnerabilities to CISA", }, ], category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Disclosure is not limited", tlp: { label: "WHITE", url: "https://us-cert.cisa.gov/tlp/", }, }, lang: "en-US", notes: [ { category: "general", text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", title: "CISA Disclaimer", }, { category: "legal_disclaimer", text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", title: "Legal Notice", }, { category: "summary", text: "Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.", title: "Risk evaluation", }, { category: "other", text: "Multiple Sectors", title: "Critical infrastructure sectors", }, { category: "other", text: "Worldwide", title: "Countries/areas deployed", }, { category: "other", text: "Germany", title: "Company headquarters location", }, { category: "general", text: "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:", title: "Recommended Practices", }, { category: "general", text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", title: "Recommended Practices", }, { category: "general", text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", title: "Recommended Practices", }, { category: "general", text: "CISA also recommends users take the following measures to protect themselves from social engineering attacks:", title: "Recommended Practices", }, { category: "other", text: "No known public exploits specifically target these vulnerabilities.", title: "Exploitability", }, ], publisher: { category: "coordinator", contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", name: "CISA", namespace: "https://www.cisa.gov/", }, references: [ { category: "self", summary: "ICS Advisory ICSA-21-308-01 JSON", url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-308-01.json", }, { category: "self", summary: "ICS Advisory ICSA-21-308-01 Web Version", url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-308-01", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/ncas/tips/ST04-014", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B", }, ], title: "VISAM VBASE Editor", tracking: { current_release_date: "2021-11-04T00:00:00.000000Z", generator: { engine: { name: "CISA CSAF Generator", version: "1.0.0", }, }, id: "ICSA-21-308-01", initial_release_date: "2021-11-04T00:00:00.000000Z", revision_history: [ { date: "2021-11-04T00:00:00.000000Z", legacy_version: "Initial", number: "1", summary: "ICSA-21-308-01 VISAM VBASE Editor", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "11.6.0.6", product: { name: "VBASE Pro-RT/ Server-RT (Web Remote): Version 11.6.0.6", product_id: "CSAFPID-0001", }, }, ], category: "product_name", name: "VBASE Pro-RT/ Server-RT (Web Remote)", }, ], category: "vendor", name: "VISAM", }, ], }, vulnerabilities: [ { cve: "CVE-2021-38417", cwe: { id: "CWE-284", name: "Improper Access Control", }, notes: [ { category: "summary", text: "The affected product is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.CVE-2021-38417has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38417", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 7.4, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-42535", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, notes: [ { category: "summary", text: "The affected product does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.CVE-2021-42535 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42535", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-42537", cwe: { id: "CWE-611", name: "Improper Restriction of XML External Entity Reference", }, notes: [ { category: "summary", text: "The affected software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.CVE-2021-42537 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42537", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-34803", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2020-13699", cwe: { id: "CWE-88", name: "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2019-18988", cwe: { id: "CWE-521", name: "Weak Password Requirements", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2018-16550", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2018-14333", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2005-2475", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, ], }
icsa-21-308-01
Vulnerability from csaf_cisa
Published
2021-11-04 00:00
Modified
2021-11-04 00:00
Summary
VISAM VBASE Editor
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.
Critical infrastructure sectors
Multiple Sectors
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Recommended Practices
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Exploitability
No known public exploits specifically target these vulnerabilities.
{ document: { acknowledgments: [ { names: [ "Michael Heinzl", ], summary: "reporting these vulnerabilities to CISA", }, ], category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Disclosure is not limited", tlp: { label: "WHITE", url: "https://us-cert.cisa.gov/tlp/", }, }, lang: "en-US", notes: [ { category: "general", text: "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", title: "CISA Disclaimer", }, { category: "legal_disclaimer", text: "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", title: "Legal Notice", }, { category: "summary", text: "Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.", title: "Risk evaluation", }, { category: "other", text: "Multiple Sectors", title: "Critical infrastructure sectors", }, { category: "other", text: "Worldwide", title: "Countries/areas deployed", }, { category: "other", text: "Germany", title: "Company headquarters location", }, { category: "general", text: "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:", title: "Recommended Practices", }, { category: "general", text: "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", title: "Recommended Practices", }, { category: "general", text: "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", title: "Recommended Practices", }, { category: "general", text: "CISA also recommends users take the following measures to protect themselves from social engineering attacks:", title: "Recommended Practices", }, { category: "other", text: "No known public exploits specifically target these vulnerabilities.", title: "Exploitability", }, ], publisher: { category: "coordinator", contact_details: "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", name: "CISA", namespace: "https://www.cisa.gov/", }, references: [ { category: "self", summary: "ICS Advisory ICSA-21-308-01 JSON", url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-308-01.json", }, { category: "self", summary: "ICS Advisory ICSA-21-308-01 Web Version", url: "https://www.cisa.gov/news-events/ics-advisories/icsa-21-308-01", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/ncas/tips/ST04-014", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf", }, { category: "external", summary: "Recommended Practices", url: "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B", }, ], title: "VISAM VBASE Editor", tracking: { current_release_date: "2021-11-04T00:00:00.000000Z", generator: { engine: { name: "CISA CSAF Generator", version: "1.0.0", }, }, id: "ICSA-21-308-01", initial_release_date: "2021-11-04T00:00:00.000000Z", revision_history: [ { date: "2021-11-04T00:00:00.000000Z", legacy_version: "Initial", number: "1", summary: "ICSA-21-308-01 VISAM VBASE Editor", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "11.6.0.6", product: { name: "VBASE Pro-RT/ Server-RT (Web Remote): Version 11.6.0.6", product_id: "CSAFPID-0001", }, }, ], category: "product_name", name: "VBASE Pro-RT/ Server-RT (Web Remote)", }, ], category: "vendor", name: "VISAM", }, ], }, vulnerabilities: [ { cve: "CVE-2021-38417", cwe: { id: "CWE-284", name: "Improper Access Control", }, notes: [ { category: "summary", text: "The affected product is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.CVE-2021-38417has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38417", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 7.4, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-42535", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, notes: [ { category: "summary", text: "The affected product does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.CVE-2021-42535 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42535", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-42537", cwe: { id: "CWE-611", name: "Improper Restriction of XML External Entity Reference", }, notes: [ { category: "summary", text: "The affected software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.CVE-2021-42537 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-42537", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2021-34803", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2020-13699", cwe: { id: "CWE-88", name: "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2019-18988", cwe: { id: "CWE-521", name: "Weak Password Requirements", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2018-16550", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2018-14333", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, { cve: "CVE-2005-2475", cwe: { id: "CWE-427", name: "Uncontrolled Search Path Element", }, notes: [ { category: "summary", text: "The affected product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy. The following CVEs are associated with this product.CVE-2021-34803, CVE-2020-13699, CVE-2019-18988, CVE-2018-16550, CVE-2018-14333, CVE-2005-2475 have been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).", title: "Vulnerability Summary", }, ], product_status: { known_affected: [ "CSAFPID-0001", ], }, references: [ { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34803", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13699", }, { category: "external", summary: "web.nvd.nist.gov", url: "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18988", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-16550", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-14333", }, { category: "external", summary: "nvd.nist.gov", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { category: "external", summary: "www.first.org", url: "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", }, ], remediations: [ { category: "mitigation", details: "VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/download.php", }, { category: "mitigation", details: "For more information, please contact VISAM using the information provided on the company contact page.", product_ids: [ "CSAFPID-0001", ], url: "https://www.vbase.net/en/contact.php", }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "CSAFPID-0001", ], }, ], }, ], }
ghsa-3m3m-6r6c-8m58
Vulnerability from github
Published
2022-05-03 03:14
Modified
2022-05-03 03:14
Details
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
{ affected: [], aliases: [ "CVE-2005-2475", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2005-08-05T04:00:00Z", severity: "LOW", }, details: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", id: "GHSA-3m3m-6r6c-8m58", modified: "2022-05-03T03:14:14Z", published: "2022-05-03T03:14:14Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-2475", }, { type: "WEB", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { type: "WEB", url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { type: "WEB", url: "http://secunia.com/advisories/16309", }, { type: "WEB", url: "http://secunia.com/advisories/16985", }, { type: "WEB", url: "http://secunia.com/advisories/17006", }, { type: "WEB", url: "http://secunia.com/advisories/17045", }, { type: "WEB", url: "http://secunia.com/advisories/17342", }, { type: "WEB", url: "http://secunia.com/advisories/17653", }, { type: "WEB", url: "http://secunia.com/advisories/25098", }, { type: "WEB", url: "http://securityreason.com/securityalert/32", }, { type: "WEB", url: "http://www.debian.org/security/2005/dsa-903", }, { type: "WEB", url: "http://www.info-zip.org/FAQ.html", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, { type: "WEB", url: "http://www.osvdb.org/18530", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { type: "WEB", url: "http://www.securityfocus.com/bid/14450", }, { type: "WEB", url: "http://www.trustix.org/errata/2005/0053", }, { type: "WEB", url: "http://www.ubuntu.com/usn/usn-191-1", }, ], schema_version: "1.4.0", severity: [], }
fkie_cve-2005-2475
Vulnerability from fkie_nvd
Published
2005-08-05 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
References
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:info-zip:unzip:5.52:*:*:*:*:*:*:*", matchCriteriaId: "B6E12425-5797-46E1-AD6E-0F6616A36A50", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.", }, { lang: "es", value: "Race condition en Unzip 5.52 permite que usuarios locales modifiquen permisos de ficheros arbitrarios mediante un ataque a un fichero que se esté descomprimiendo (cuyos permisos serán cambiados por Unzip después de que la descompresión se complete).", }, ], id: "CVE-2005-2475", lastModified: "2025-04-03T01:03:51.193", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "LOW", cvssData: { accessComplexity: "HIGH", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "NONE", baseScore: 1.2, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:L/AC:H/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 1.9, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2005-08-05T04:00:00.000", references: [ { source: "cve@mitre.org", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { source: "cve@mitre.org", url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/16309", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/16985", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/17006", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/17045", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/17342", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/17653", }, { source: "cve@mitre.org", url: "http://secunia.com/advisories/25098", }, { source: "cve@mitre.org", url: "http://securityreason.com/securityalert/32", }, { source: "cve@mitre.org", url: "http://www.debian.org/security/2005/dsa-903", }, { source: "cve@mitre.org", url: "http://www.info-zip.org/FAQ.html", }, { source: "cve@mitre.org", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, { source: "cve@mitre.org", url: "http://www.osvdb.org/18530", }, { source: "cve@mitre.org", url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/14450", }, { source: "cve@mitre.org", url: "http://www.trustix.org/errata/2005/0053/", }, { source: "cve@mitre.org", url: "http://www.ubuntu.com/usn/usn-191-1", }, { source: "cve@mitre.org", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://marc.info/?l=bugtraq&m=112300046224117&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/16309", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/16985", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/17006", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/17045", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/17342", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/17653", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://secunia.com/advisories/25098", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securityreason.com/securityalert/32", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2005/dsa-903", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.info-zip.org/FAQ.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2005:197", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.osvdb.org/18530", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.redhat.com/support/errata/RHSA-2007-0203.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/14450", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.trustix.org/errata/2005/0053/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.ubuntu.com/usn/usn-191-1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975", }, ], sourceIdentifier: "cve@mitre.org", vendorComments: [ { comment: "Red Hat is aware of this issue and is tracking it via the following bug:\nhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=164927\n\nThe Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:\nhttp://www.redhat.com/security/updates/classification/\n\nRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.\n\nThe risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 which is in maintenance mode.", lastModified: "2007-09-05T00:00:00", organization: "Red Hat", }, ], vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "NVD-CWE-Other", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.