| Package | unzip |
|---|---|
| Version | 6.0-21+deb9u4 (stretch), 6.0-23+deb10u4 (buster) |
Akhil Koul discovered a vulnerability in the Info-ZIP unzip program which could result in the execution of arbitrary code if a specially crafted file is processed.
In addition to this vulnerability, two non-security crashes (#1142904 and #1142905) have been fixed.
For Debian 10 buster, these problems have been fixed in version 6.0-23+deb10u4.
For Debian 9 stretch, these problems have been fixed in version 6.0-21+deb9u4.
We recommend that you upgrade your unzip packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.