ELA-141-2 unzip regression update

regression update

Related CVEs CVE-2019-13232

The unzip security update issued as ELA 141-1 caused a regression when extracting some non-standard zip files.

For instance there is a zip-like file in the Firefox distribution, omni.ja, which is a zip container with the central directory placed at the start of the file instead of after the local entries as required by the zip standard. This update now permits such containers to not raise a zip bomb alert, where in fact there are no overlaps.

For Debian 7 Wheezy, these problems have been fixed in version 6.0-8+deb7u8.

We recommend that you upgrade your unzip packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.