Your message dated Sat, 01 Aug 2026 10:19:49 +0000
with message-id <[email protected]>
and subject line Bug#1142905: fixed in unzip 6.0-30
has caused the Debian Bug report #1142905,
regarding unzip: stack out-of-bounds NUL write in EF_SMARTZIP handler
[CAN-2026-2034443]
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142905: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142905
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: unzip
Version: 6.0-28
Severity: grave
Tags: security
X-Debbugs-Cc: [email protected], [email protected]
Hi,
InfoZIP unzip 6.0 contains a stack out-of-bounds NUL byte write in the
EF_SMARTZIP (ID 0x4d63) extra field handler in zipinfo.c. An attacker-
controlled byte from the extra field data is used as an array index to
NUL-terminate a 32-byte stack buffer, without any bounds check.
CAN: CAN-2026-2034443 (pending assignment from MITRE)
CWE: CWE-787 (Out-of-bounds Write) / CWE-121 (Stack-based Buffer Overflow)
CVSS: High (stack OOB write)
ROOT CAUSE (zipinfo.c, lines 1766-1769):
case EF_SMARTZIP:
if ((eb_datalen == EB_SMARTZIP_HLEN) &&
makelong(ef_ptr) == 0x70695A64 /* "dZip" */) {
char filenameBuf[32]; // 32-byte stack buffer
zi_showMacTypeCreator(__G__ &ef_ptr[4]);
memcpy(filenameBuf, &ef_ptr[33], 31); // copies 31 bytes (safe)
filenameBuf[ef_ptr[32]] = '\0'; // NUL WRITE at attacker-
// controlled index!
...
ef_ptr[32] is a byte from the extra field data (attacker-controlled,
range 0-255). filenameBuf is only 32 bytes (indices 0-31 valid). When
ef_ptr[32] > 31, the NUL write lands past the stack buffer boundary.
With ef_ptr[32] = 200, the write is at offset 200 — 168 bytes past
the end of the 32-byte buffer.
TRIGGER: zipinfo poc.zip (or unzip -Z -v poc.zip) where poc.zip has
a file with an EF_SMARTZIP extra field (ID 0x4d63) of exactly
EB_SMARTZIP_HLEN bytes, magic "dZip" at offset 0, and byte value > 31
at offset 32.
ASAN OUTPUT:
==8==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xffffeb74aeb8 at pc 0xaaaad8522268
WRITE of size 1 at 0xffffeb74aeb8 thread T0
#0 0xaaaad8522264 (zipinfo.c, EF_SMARTZIP handler)
Address 0xffffeb74aeb8 is located in stack of thread T0:
[336, 368) 'filenameBuf.i' (line 1704)
Memory access at offset 536 overflows this variable (32 bytes at
stack offset 336-368, write landed at offset 536 = 168 bytes past
the end).
IMPACT: Stack buffer overflow (single NUL byte) with attacker-
controlled offset. While limited to writing a NUL byte, the offset
into the stack is fully controlled (0-255), allowing corruption of
saved frame pointers, local variables, or return addresses depending
on stack layout. At minimum: crash (DoS). Triggered by a user running
zipinfo on a crafted ZIP file.
SUGGESTED FIX:
memcpy(filenameBuf, &ef_ptr[33], 31);
- filenameBuf[ef_ptr[32]] = '\0';
+ {
+ unsigned idx = (unsigned)ef_ptr[32];
+ if (idx > 31) idx = 31;
+ filenameBuf[idx] = '\0';
+ }
Or more conservatively, always NUL-terminate at index 31:
memcpy(filenameBuf, &ef_ptr[33], 31);
filenameBuf[31] = '\0';
Best regards,
Akhil Koul
--- End Message ---
--- Begin Message ---
Source: unzip
Source-Version: 6.0-30
Done: Santiago Vila <[email protected]>
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <[email protected]> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 01 Aug 2026 11:50:00 +0200
Source: unzip
Architecture: source
Version: 6.0-30
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <[email protected]>
Changed-By: Santiago Vila <[email protected]>
Closes: 1142904 1142905
Changes:
unzip (6.0-30) unstable; urgency=medium
.
* Stop prefixing patch filenames with numbers.
* Fix invalid DEP3 metadata.
* Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
(heap out-of-bounds read in EF_IZUNIX3 extra field handler)
* Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
(stack out-of-bounds NUL write in EF_SMARTZIP handler)
* Drop "Rules-Requires-Root: no" (default).
* Drop "Priority: optional" (default).
* Update standards-version.
* Disable redundant/duplicate Salsa CI jobs.
* Drop no longer needed lintian override.
Checksums-Sha1:
276d42f4df3953c67e832c6b4ad4cbec1d746412 1463 unzip_6.0-30.dsc
7ad53fb776af0dec6b0ef277b1636dbe9290ca65 26948 unzip_6.0-30.debian.tar.xz
b5adf28f817ae327fe3aa91b381eac57debc700c 5416 unzip_6.0-30_source.buildinfo
Checksums-Sha256:
7ba160de9860d197ae42fb8c574e098692e320c3ee61a75616df68f47481cc9f 1463
unzip_6.0-30.dsc
c63a485e25b61a87ccd62915579d38a6f37823018a1267f354f25161bdb96632 26948
unzip_6.0-30.debian.tar.xz
75f44c3f1bf92dc2ac47e2b5cf0ea1e4c4b38ec3facd30348571e8aba9380f3f 5416
unzip_6.0-30_source.buildinfo
Files:
00c7c52eabe1014a46cff1bebe80be29 1463 utils optional unzip_6.0-30.dsc
7f95a3d99c1db0fc1b2b51b8f91cfa02 26948 utils optional
unzip_6.0-30.debian.tar.xz
07ac7ff5eb8debf012daed911055274d 5416 utils optional
unzip_6.0-30_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmptwowACgkQQc5/C58b
izInsQf+JsTMzfbd+AzfQuEc7cwDQEZ5674XIrqAAcLehQ0Wim6afSxkD19YMf8b
+rsUN3MBqLsugNY1aNJKUsy4r7UVrPcaLCTFk5qcXO6c6dF7E8sI7DK69CygQrIx
qc8MDNxwjnG/nYh7Ape/WFImbkHs4nsHdg9PR1GzxqzlJEWPku12rSvv3YJAfqbv
WcLfEVm9W2biXB7lYm/PD5KSwGkkEFr8bmitz9KywTTghPiHMgcAQm3wlojxG1/w
7yWIRbPbkVYu8u8Tsem0EBQlCJ6TD2Bl1GgXGpmyDFj1eA2QRAwokrmU0GOP2P0W
wa/5SCXTVk79nAf3iFxqaS88jIR/yw==
=Ta+a
-----END PGP SIGNATURE-----
pgpGHXCr715c_.pgp
Description: PGP signature
--- End Message ---
