Nixpkgs security tracker

Dismissed

Permalink CVE-2008-0888

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 10 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

The NEEDBITS macro in the inflate_dynamic function in inflate.c for …

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

References

29415 third-party-advisoryx_refsource_SECUNIAx_transferred
20080321 rPSA-2008-0116-1 unzip mailing-listx_refsource_BUGTRAQx_transferred
29427 third-party-advisoryx_refsource_SECUNIAx_transferred
ADV-2008-1744 x_refsource_VUPENvdb-entryx_transferred
29440 third-party-advisoryx_refsource_SECUNIAx_transferred
DSA-1522 vendor-advisoryx_refsource_DEBIANx_transferred
29432 third-party-advisoryx_refsource_SECUNIAx_transferred
https://issues.rpath.com/browse/RPL-2317 x_refsource_CONFIRMx_transferred
http://wiki.rpath.com/Advisories:rPSA-2008-0116 x_refsource_CONFIRMx_transferred
http://www.vmware.com/security/advisories/VMSA-2008-0009.html x_refsource_CONFIRMx_transferred
APPLE-SA-2010-03-29-1 x_refsource_APPLEvendor-advisoryx_transferred
29392 third-party-advisoryx_refsource_SECUNIAx_transferred
29681 third-party-advisoryx_refsource_SECUNIAx_transferred
MDVSA-2008:068 vendor-advisoryx_refsource_MANDRIVAx_transferred
SUSE-SR:2008:007 vendor-advisoryx_refsource_SUSEx_transferred
ADV-2008-0913 x_refsource_VUPENvdb-entryx_transferred
30535 third-party-advisoryx_refsource_SECUNIAx_transferred
http://www.ipcop.org/index.php?name=News&file=article&sid=40 x_refsource_CONFIRMx_transferred
http://support.apple.com/kb/HT4077 x_refsource_CONFIRMx_transferred
20080604 VMSA-2008-0009 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues mailing-listx_refsource_BUGTRAQx_transferred
GLSA-200804-06 x_refsource_GENTOOvendor-advisoryx_transferred
oval:org.mitre.oval:def:9733 vdb-entryx_refsource_OVALsignaturex_transferred
29406 third-party-advisoryx_refsource_SECUNIAx_transferred
29495 third-party-advisoryx_refsource_SECUNIAx_transferred
31204 third-party-advisoryx_refsource_SECUNIAx_transferred
1019634 x_refsource_SECTRACKvdb-entryx_transferred
RHSA-2008:0196 vendor-advisoryx_refsource_REDHATx_transferred
unzip-inflatedynamic-code-execution(41246) x_refsource_XFvdb-entryx_transferred
USN-589-1 vendor-advisoryx_refsource_UBUNTUx_transferred
28288 x_refsource_BIDvdb-entryx_transferred
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0116 x_refsource_CONFIRMx_transferred

Affected products

n/a

==n/a

unzip

<6.0

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable -
- nixpkgs-unstable 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable -
- nixpkgs-unstable 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable -
- nixpkgs-unstable 2.0.3

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable -
- nixpkgs-unstable 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable -
- nixpkgs-unstable 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable -
- nixpkgs-unstable 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/672d3856df5d0e0e5bd5053e59cd5925b85e9f4a

Dismissed

Permalink CVE-2014-8140

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
- runzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip …

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174851 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Dismissed

Permalink CVE-2014-8141

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip …

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174856 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Dismissed

Permalink CVE-2014-8139

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- runzip
- ripunzip
- unzipNLS
- haskellPackages.unzip-traversable
- haskellPackages.wai-middleware-gunzip
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip …

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References

http://www.ocert.org/advisories/ocert-2014-011.html x_refsource_MISCx_transferred
https://access.redhat.com/errata/RHSA-2015:0700 x_refsource_MISCx_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=1174844 x_refsource_MISCx_transferred
http://www.securitytracker.com/id/1031433 x_refsource_MISCx_transferred

Affected products

UnZip

==6.0 and earlier

Matching in nixpkgs

pkgs.unzip

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

Ignored packages (5)

pkgs.runzip

Tool to convert filename encoding inside a ZIP archive

nixos-unstable 1.4
- nixpkgs-unstable 1.4
- nixos-unstable-small 1.4

pkgs.ripunzip

Tool to unzip files in parallel

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4

pkgs.unzipNLS

Extraction utility for archives compressed in .zip format

nixos-unstable 6.0
- nixpkgs-unstable 6.0
- nixos-unstable-small 6.0

pkgs.haskellPackages.unzip-traversable

Unzip functions for general Traversable containers

nixos-unstable 0.1.1
- nixpkgs-unstable 0.1.1
- nixos-unstable-small 0.1.1

pkgs.haskellPackages.wai-middleware-gunzip

WAI middleware to unzip request bodies

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2

Package maintainers

@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>

Current stable branch was never impacted

https://github.com/NixOS/nixpkgs/commit/173f41cf0bc618f0b2c313b1915fee8d8a6d0ee2

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.unzip

pkgs.runzip

pkgs.ripunzip

pkgs.unzipNLS

pkgs.haskellPackages.unzip-traversable

pkgs.haskellPackages.wai-middleware-gunzip

Package maintainers