CVE-2015-7697: unzip: Infinite loop when extracting password-protected archive

Debian Bug report logs - #802160
CVE-2015-7697: unzip: Infinite loop when extracting password-protected archive

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: CVE-2015-7697: unzip: Infinite loop when extracting password-protected archive

Date: Sat, 17 Oct 2015 23:40:23 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: unzip
Version: 6.0-18
Severity: normal
Tags: security

Infinite loop when extracting password-protected archive issue has been
from from unzip. Proof-of-concept file can be downloaded from
http://seclists.org/oss-sec/2015/q3/att-512/sigxcpu_zip.bin

Announcement: http://www.openwall.com/lists/oss-security/2015/09/07/4

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJWIrI3AAoJECet96ROqnV0zY8P/2VJEDLAnX60/vGlGBDW9o0D
PcwNE2DQrbq677AWejDeZJRpZ2xZmdK92YOFnkgNQsFWGDuJN/T8lKLurRb2vuJ0
Iv7KwwJ6tgrNqlKW2YPaZSx0QS765F8G510F/Z3ql/8VYY0Y0dTMdwyWN3HQyWrD
e7fVtQxcvXzBhVsIGOfuRLWAUFMOPg8svcZ9sh0aOi2i1q38NA8OAaeousY2nBkI
p60yr8QEBYM2XK3kRE9yrgx9APbMobw7hhrkOl5ZwmhWUcicCT5L5i/RH202afbc
BYF7Ds8FrOMkTiSxAosk/4nMP0tg0J6IaZ1JfoxP8dQ1LEEwPqhfA+p0efRzu8SI
PO+JOZ/m0TKFlTjh7xhUf93G2wRWcGLq9lr1oz8MyKoyf/32XptomoO3l3MblkGo
Ly6fkNj/LMTT4G9gSF/uqaihJWFBrSeVIgmwlk7wWmq96PrFd+UFjGAlbgoywj+X
KpOli0P4KH/HOAKRLWjbLgm45iyF8tVymuebTtG9ULOj9cJgHWloNoJJCIPU35VZ
Y4nWO/Kq37qgv3Ug5YyfaQhBmY52YSFvglTHyE+EBDRZGmrnudJ97h4yR/c79n5K
bHdfD7dLscSwI8brLn7HNwXB88MmP+YEeYz7wNcptefdlsbFMLh8d3CwRvKAK7jm
TPtOwvJg2KUVd+4bff9h
=tqjh
-----END PGP SIGNATURE-----

Message #12 received at 802160@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: 802162@bugs.debian.org, 802160@bugs.debian.org

Subject: Patches are available

Date: Thu, 22 Oct 2015 10:33:49 +0200

Control: tag -1 patch

RedHat prepared some patches for those two issues:
https://bugzilla.redhat.com/attachment.cgi?id=1073339

Additionnaly they have another patch for an unsigned
integer underflow:
https://bugzilla.redhat.com/attachment.cgi?id=1075942

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/

Message #19 received at 802160@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Raphael Hertzog <hertzog@debian.org>, 802160@bugs.debian.org

Cc: 802162@bugs.debian.org

Subject: Re: Bug#802160: Patches are available

Date: Thu, 22 Oct 2015 10:44:40 +0200

On Thu, Oct 22, 2015 at 10:33:49AM +0200, Raphael Hertzog wrote:
> Control: tag -1 patch
> 
> RedHat prepared some patches for those two issues:
> https://bugzilla.redhat.com/attachment.cgi?id=1073339
> 
> Additionnaly they have another patch for an unsigned
> integer underflow:
> https://bugzilla.redhat.com/attachment.cgi?id=1075942

Thanks a lot, this makes my job easier indeed.

Message #24 received at 802160@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: Santiago Vila <sanvila@unex.es>

Cc: 802160@bugs.debian.org, 802162@bugs.debian.org

Subject: Re: Bug#802160: Patches are available

Date: Thu, 22 Oct 2015 11:04:39 +0200

[Message part 1 (text/plain, inline)]

On Thu, 22 Oct 2015, Santiago Vila wrote:
> Thanks a lot, this makes my job easier indeed.

Here are the individual patches with proper DEP-3 headers that I just
prepared for the squeeze-lts upload that I'm working on.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/

[CVE-2015-7696.patch (text/x-diff, attachment)]

[CVE-2015-7697.patch (text/x-diff, attachment)]

[fix-integer-underflow-csiz-decrypted.patch (text/x-diff, attachment)]

Message #29 received at 802160-close@bugs.debian.org (full text, mbox, reply):

From: Raphaël Hertzog <hertzog@debian.org>

To: 802160-close@bugs.debian.org

Subject: Bug#802160: fixed in unzip 6.0-4+deb6u3

Date: Thu, 22 Oct 2015 09:39:21 +0000

Source: unzip
Source-Version: 6.0-4+deb6u3

We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802160@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Raphaël Hertzog <hertzog@debian.org> (supplier of updated unzip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 22 Oct 2015 10:49:06 +0200
Source: unzip
Binary: unzip
Architecture: source amd64
Version: 6.0-4+deb6u3
Distribution: squeeze-lts
Urgency: medium
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Raphaël Hertzog <hertzog@debian.org>
Description: 
 unzip      - De-archiver for .zip files
Closes: 802160 802162
Changes: 
 unzip (6.0-4+deb6u3) squeeze-lts; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS team.
   * CVE-2015-7696: Fix heap overflow. Closes: #802162
   * CVE-2015-7697: Fix denial of service due to infinite loop with
     some invalid input data. Closes: #802160
   * Add a third patch fixing an integer underflow found by
     Stefan Cornelius.
Checksums-Sha1: 
 432b5f3bc197d2928ca10c41ff1f23e86588ecb6 1324 unzip_6.0-4+deb6u3.dsc
 c47de49294436e645bcd9999adbeb61de32e41e0 15442 unzip_6.0-4+deb6u3.debian.tar.gz
 a2d5e0061b70abb8ab412fa5af4dcef22a480cae 192038 unzip_6.0-4+deb6u3_amd64.deb
Checksums-Sha256: 
 f1e9c37bea565eafccd68237439c37e9b783997421f546d11ea05dcbb8a4093a 1324 unzip_6.0-4+deb6u3.dsc
 8630ce83f64a309da0cae342179461ebde93f0cf82dde357224db4fb4f59736b 15442 unzip_6.0-4+deb6u3.debian.tar.gz
 b387abd4a9c5940e98f96e60c81b6ff4dc7c3c352e86d29cba06137fdab7dd45 192038 unzip_6.0-4+deb6u3_amd64.deb
Files: 
 207e64938b5c6062ac01f57c0f566f1f 1324 utils optional unzip_6.0-4+deb6u3.dsc
 36e379ddd9d11dab908f8a88181c1083 15442 utils optional unzip_6.0-4+deb6u3.debian.tar.gz
 366ec34df6c20e56be23351f630eae55 192038 utils optional unzip_6.0-4+deb6u3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Signed by Raphael Hertzog

iQEcBAEBCAAGBQJWKKs/AAoJEAOIHavrwpq5QFIH/1K4N9RtSAZY4N3WVm/WUe/0
AtiG75N94atCCBRgv+6W2kSPMVDuVZs68CZoe8s0k+7xXPgW8zSUAZqlGEc179Qz
9pIPgvR2vjRZbOwsnhcUdTl+zSNEK+BJTWcbY4k8msTRTW5cM2N2aaiQWBbZdTUH
8WTaTRaf72xbKmRMH+WhLmjYWtftmb5bauq6SgdAlAwn0wu58uRkHCYq04D2XlQ/
/QkjazsFXxqIYk4HN6fE1dUzvR9B3I0/mkUAL9SNYEGMX4yjJfNCAoofibZAvw22
PSGbrUwNd+IrUkmdnHKKZfznh4rmFwciBnMQEIwOqrpCVv0h7eGMtfFQas3llhc=
=N6GF
-----END PGP SIGNATURE-----

Message #34 received at 802160-close@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@debian.org>

To: 802160-close@bugs.debian.org

Subject: Bug#802160: fixed in unzip 6.0-19

Date: Thu, 22 Oct 2015 10:23:07 +0000

Source: unzip
Source-Version: 6.0-19

We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802160@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated unzip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 22 Oct 2015 12:12:46 +0200
Source: unzip
Binary: unzip
Architecture: source
Version: 6.0-19
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 802160 802162
Changes:
 unzip (6.0-19) unstable; urgency=medium
 .
   * Fix infinite loop when extracting password-protected archive.
     This is CVE-2015-7697. Closes: #802160.
   * Fix heap overflow when extracting password-protected archive.
     This is CVE-2015-7696. Closes: #802162.
   * Fix additional unsigned overflow on invalid input.
   * Thanks a lot to Raphaël Hertzog for the squeeze-lts release,
     from which this upload is mainly derived.
Checksums-Sha1:
 f0195938e7aa520a307870dfb7b24d6d5338ee1b 1329 unzip_6.0-19.dsc
 e9365b87fff0d7c5c1888568b33bc88008f9b60c 16616 unzip_6.0-19.debian.tar.xz
Checksums-Sha256:
 44ff301e56edc2dedc4b180d781966363b48ae613ca4b677876c17dd40243647 1329 unzip_6.0-19.dsc
 1dbe8726dbb4ce7ac645e4700421d3a30650bd257ffe2271ac4be8dc4c939208 16616 unzip_6.0-19.debian.tar.xz
Files:
 9aed6673bd2113f3ef6dc862a8541a8d 1329 utils optional unzip_6.0-19.dsc
 eace08b51823c3cec0db075171184728 16616 utils optional unzip_6.0-19.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWKLbuAAoJEEHOfwufG4syynwH/jX+92YSPA3uUbKBv3MTEJI/
oXP4ffn+ibSIbhb0Uuwedi4ZadxCOG2JKvpdgw0sla6IGgPMRf3DMSIZ0feTz3lo
qUoeWt12OJu7w12borIbRaMC3RlgPa0xfQUENut5v+AIEtQhkQKQPrq8cYm3vuw/
2JECzZiND45oGe295jxaHBlrwRsfR80Kp19CRqjsLQNlXYS8Drpw68nDP92siI+g
8C5zA3ZN0n6ndzXrWOaFW/or2XTTvrX/0q8PJab8LYdPBn9Pqsp64qwKiwpx9cJp
u91tgGmIOuy6WVAir/6GCtEtffADKJ+0JD3SeUZq88qQmbl4wi5lHboh4A4RD6Q=
=5aUy
-----END PGP SIGNATURE-----

Message #41 received at 802160-close@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi (GCS) <gcs@debian.org>

To: 802160-close@bugs.debian.org

Subject: Bug#802160: fixed in unzip 6.0-16+deb8u1

Date: Sat, 31 Oct 2015 21:18:42 +0000

Source: unzip
Source-Version: 6.0-16+deb8u1

We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802160@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated unzip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 22 Oct 2015 12:51:52 +0000
Source: unzip
Binary: unzip
Architecture: source amd64
Version: 6.0-16+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 802160 802162
Changes:
 unzip (6.0-16+deb8u1) jessie-security; urgency=high
 .
    * Non-maintainer upload by the Security Team.
    * Fix infinite loop when extracting password-protected archive.
      This is CVE-2015-7697. Closes: #802160.
    * Fix heap overflow when extracting password-protected archive.
      This is CVE-2015-7696. Closes: #802162.
    * Fix additional unsigned overflow on invalid input.
Checksums-Sha1:
 a35718aa518e18a15dfb53a3b63d30d97543b9ec 1685 unzip_6.0-16+deb8u1.dsc
 abf7de8a4018a983590ed6f5cbd990d4740f8a22 1376845 unzip_6.0.orig.tar.gz
 cf31bacbd1ed2a003c5b0fc0b00de74962998c9d 15372 unzip_6.0-16+deb8u1.debian.tar.xz
 9e00bf478436027b7f7f2869db9b8cc9dc85e3cc 161794 unzip_6.0-16+deb8u1_amd64.deb
Checksums-Sha256:
 26178443053c58792692ad3dc1f78df3719360b38b2aae5cb820768dd3c30c12 1685 unzip_6.0-16+deb8u1.dsc
 036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37 1376845 unzip_6.0.orig.tar.gz
 e24d2a7f93e717ba69c5f1d8f68884cf0c20008e1d525268b0f6133bdc14c46a 15372 unzip_6.0-16+deb8u1.debian.tar.xz
 79604b090126c9904680469b2630e3b8f8cd5bdb8b90c69b1b31f9d019837f70 161794 unzip_6.0-16+deb8u1_amd64.deb
Files:
 72063177ca672fc005166298749299c0 1685 utils optional unzip_6.0-16+deb8u1.dsc
 62b490407489521db863b523a7f86375 1376845 utils optional unzip_6.0.orig.tar.gz
 9585bf3617df6fc0a15e1b292701ed14 15372 utils optional unzip_6.0-16+deb8u1.debian.tar.xz
 370eca35d7eeb03e7ca10b7c82c300b9 161794 utils optional unzip_6.0-16+deb8u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWKef1AAoJENzjEOeGTMi/oeoP/jokgmFVWIJmvkC1B4ghLmfc
8ROxOuVq2qR/10q12eaz6q/R3jVcyLavTVyvfu4a9zo51UHdvbwVE6IGLVQxnGly
ukmZJuRSp8dpqxvSrECkxojawCM6M+jPEweOGWz0Y8XBAyTy9UG8rsGJenIcSHfR
PTxu/+4KAwnsAohq/wRaKcSBWxva0o3y1AjAqPEvhtljsGodtZRXmbbmih9plwR0
LHskP//0wLKJz9jocmHtI1ys6NhUBjujj9oEum9uL1g3wFNgIzMa0R4ow9jYsxz3
9TMRm98fylMQMqp8+RXyVUL7AhybTSUlv/ss7paxDqBSs3BSw2zVrqMiO/TmQF7B
thWFcPKC9FPjCKChdLdfiy+Pkq1GzZm7xFspJ0i7yxAZ2IL5XQOWOh6g0TdgnnVN
A+DYlEcF3yvUAFw4kHovFrl5+wJX1OLGLhfbGXD8EoC46cCG4RwRPsK+T2BQO0fD
KM34wIlahbbW/3SBP8yqwhstYfQ3PwFKFJJwh48GohkbMyzv5zlz9T8W5ZvjVcsr
r2mQx/m+nFxRyl2PvUkfYYFbheE+1wx/Hv0tCjYen7ybUGscY/5Da1sR09LJR1UU
e8c61jn/dU9bOx410Nd/cLktS1vhWArKHKOnbQctaPs0qzJzFNAeJADqKQlMmSWK
Kzcybm79CoPvTnBnGorA
=FLX8
-----END PGP SIGNATURE-----

Message #46 received at 802160-close@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi (GCS) <gcs@debian.org>

To: 802160-close@bugs.debian.org

Subject: Bug#802160: fixed in unzip 6.0-8+deb7u4

Date: Sat, 31 Oct 2015 21:19:08 +0000

Source: unzip
Source-Version: 6.0-8+deb7u4

We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802160@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated unzip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 22 Oct 2015 12:59:24 +0000
Source: unzip
Binary: unzip
Architecture: source amd64
Version: 6.0-8+deb7u4
Distribution: wheezy-security
Urgency: high
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Description: 
 unzip      - De-archiver for .zip files
Closes: 802160 802162
Changes: 
 unzip (6.0-8+deb7u4) wheezy-security; urgency=high
 .
    * Non-maintainer upload by the Security Team.
    * Fix infinite loop when extracting password-protected archive.
      This is CVE-2015-7697. Closes: #802160.
    * Fix heap overflow when extracting password-protected archive.
      This is CVE-2015-7696. Closes: #802162.
    * Fix additional unsigned overflow on invalid input.
Checksums-Sha1: 
 983e8410c3496a796dddc07d6b5a33e5729797da 1676 unzip_6.0-8+deb7u4.dsc
 f3f54bfc28760c590bea2e42ab615055045d693c 16408 unzip_6.0-8+deb7u4.debian.tar.gz
 07e7eabcb5f9173aaa4e61eafa708ea1e51fd850 196196 unzip_6.0-8+deb7u4_amd64.deb
Checksums-Sha256: 
 b51e1fbc8df6dd1207e20a77bfc26098dddf3bdf1393b9d3874696ae225337cc 1676 unzip_6.0-8+deb7u4.dsc
 9f2702bc4d2c558926a76298cc524eaec93d8da99f7540107217745f1f430764 16408 unzip_6.0-8+deb7u4.debian.tar.gz
 aa1b9672d69c843214f565a29a77432f9ce1a6cf495c64cc3bf63245ed86324f 196196 unzip_6.0-8+deb7u4_amd64.deb
Files: 
 a59776bbffa09226be950bd397e05ace 1676 utils optional unzip_6.0-8+deb7u4.dsc
 727356974f30d47a6f322ec433e14673 16408 utils optional unzip_6.0-8+deb7u4.debian.tar.gz
 82323d4a754cd31b8daf97a5dcd4700a 196196 utils optional unzip_6.0-8+deb7u4_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWKegIAAoJENzjEOeGTMi/C8sP+wXvdqUebQg+RbhJ63l7oMMt
V1y5Du7rPOjF3ZK4VvKBO3JHHoXIx1rh4nWskwXerhmwp0LwhsTUW7zMycGmW54D
mLcSj/lyWAces1FhidO6nZpGonNkwS0wyr3uV0neXhj4zNGHAd0CBzxVs866te6w
DGL344EKpCgPa0lhsWy6vv+W+HhDzXlsVzb1fIGrmcBPztFHWkBQjauPiAd8VHEx
7ktPYUNxL5ldfFpdjiAIY7fcbyETReIR9AZktK7/1wPzEvQq6A28bnAu5qOQc2fX
VxPnvETdGY7DII0tFMiZo6GdKeNobVK9kxe+ohnAC5Op27D1EAJx7jGj6hktjfJ4
7NQr7dFsYmnrKBtDWzaMEArqsH90kBSUqlayXZ6YYhNw0iEKKTxA1lWZ2wqIYnxh
nMQCAXhT+i8LiAJMzlImPwItfVG7+Jw6bBE569SMnUVW1y7NQZhZnHF7sDfKMGl4
4GLM1LGDT4AHfj+7E2n4rtWAbV7DYru2dDqBOAG/YtqO/P/zzXEpUoIGi9Boognt
Gp9g3PYII1RKza82VYQBdR10dPSPg6tdVYgwLWBnIONEUcKeXpHSSHcJVemKa2J2
2bZUo9vKFcj/BGmCPlu10b7VXftXPSgQEf+Q/gNxX+MXr/gmWSFEUhQF/ZJxhkdn
Umj1aRWiaxhOylaPpF3D
=+RMZ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.