Your message dated Mon, 10 Aug 2026 17:48:55 +0000
with message-id <[email protected]>
and subject line Bug#1142906: fixed in unzip 6.0-31
has caused the Debian Bug report #1142906,
regarding unzip: heap buffer overflow WRITE in memextract() STORED path
[CAN-2026-2034442]
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142906: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142906
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: unzip
Version: 6.0-28
Severity: grave
Tags: security
X-Debbugs-Cc: [email protected], [email protected]
Hi,
InfoZIP unzip 6.0 contains a heap buffer overflow WRITE in the
memextract() function (extract.c) when processing STORED-compressed
VMS extra field blocks. The allocation uses the declared uncompressed
size (usiz), but the STORED copy path uses the compressed data length
(G.incnt, derived from csiz). When csiz > usiz, memcpy writes past
the heap buffer.
CAN: CAN-2026-2034442 (pending assignment from MITRE)
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS: 8.5 High
ROOT CAUSE:
In extract_izvms_block() (extract.c, line 2645):
usiz = (cmptype == EB_IZVMS_BCSTOR ?
csiz : makeword(ebdata+EB_IZVMS_UCSIZ));
...
ucdata = (uch *)malloc(MAX(needlen, usiz)); // alloc'd with usiz
For the EB_IZVMS_BCDEFL case, memextract() is called:
memextract(__G__ ucdata, (ulg)usiz,
ebdata+EB_IZVMS_HLEN, (ulg)csiz);
Inside memextract() (extract.c, line 2523), the STORED path:
G.inptr = (uch *)src + (2 + 4);
G.incnt = (int)(G.csize = (long)(srcsize - (2 + 4))); // from csiz
...
case STORED:
memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt);
The memcpy uses G.incnt (derived from srcsize/csiz) as the copy length,
but tgt is only usiz bytes. The method field inside the extra field data
is attacker-controlled — a crafted EF_IZVMS block declares
cmptype=EB_IZVMS_BCDEFL (to reach memextract) with a method byte of
STORED=0 inside the block data, usiz=16, and csiz=86. The memcpy then
copies 80 bytes into a 16-byte buffer.
TRIGGER: unzip -a -o poc.zip where poc.zip has version_made_by=0x0214
(VMS host system) and contains a crafted EF_IZVMS extra field with
the above geometry.
ASAN OUTPUT:
==8==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xffff98400740 at pc 0xaaaacd723054
WRITE of size 80 at 0xffff98400740 thread T0
#0 __asan_memcpy
#1 memextract /build/unzip-6.0/extract.c:2523:13
#2 extract_izvms_block /build/unzip-6.0/extract.c:2660:13
#3 is_vms_varlen_txt /build/unzip-6.0/fileio.c:1181:32
#4 flush /build/unzip-6.0/fileio.c:896:17
#5 extract_or_test_member /build/unzip-6.0/extract.c:1921:21
0xffff98400740 is located 0 bytes to the right of 16-byte region
[0xffff98400730,0xffff98400740)
allocated by thread T0 here:
#1 extract_izvms_block /build/unzip-6.0/extract.c:2645:26
IMPACT: Heap buffer overflow WRITE with attacker-controlled length
(csiz - usiz - 6 bytes written past the allocation). This is a
write primitive — potential for code execution depending on heap
layout. Triggered during normal extraction of a crafted ZIP file.
SUGGESTED FIX (in memextract, STORED case):
case STORED:
+ if ((extent)G.incnt > tgtsize) {
+ error = PK_ERR;
+ break;
+ }
memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt);
Or equivalently, validate in extract_izvms_block() that csiz <= usiz + 6
before calling memextract with cmptype BCDEFL.
Best regards,
Akhil Koul
--- End Message ---
--- Begin Message ---
Source: unzip
Source-Version: 6.0-31
Done: Santiago Vila <[email protected]>
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <[email protected]> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 10 Aug 2026 19:10:00 +0200
Source: unzip
Architecture: source
Version: 6.0-31
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <[email protected]>
Changed-By: Santiago Vila <[email protected]>
Closes: 1142906
Changes:
unzip (6.0-31) unstable; urgency=medium
.
* Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
(heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
40274f7f2a89a9243542a3abb26a6681d64fa913 1463 unzip_6.0-31.dsc
e807f4edb0cc452c3937bd4e4cc79cd049049821 27232 unzip_6.0-31.debian.tar.xz
86c2acbdf53b97c0ca79e5f29b413911dce01222 5476 unzip_6.0-31_source.buildinfo
Checksums-Sha256:
1e3454cb496ae8587c265741f396c0fe7d509c6f65eb02e7f8cda3554fd5680f 1463
unzip_6.0-31.dsc
d7dc23f5254c6711dc05f467e70236cfd50a7931001c6152904474b19f295c38 27232
unzip_6.0-31.debian.tar.xz
fc4588f2073f90541dfd1d71fa903e2abfe3f0e9493c32a141b988a352b6c9c2 5476
unzip_6.0-31_source.buildinfo
Files:
3b6e15148f279773c6b443fd22c21880 1463 utils optional unzip_6.0-31.dsc
7788943231cba5e5ab2ca103aea730f8 27232 utils optional
unzip_6.0-31.debian.tar.xz
42c2d0034cb51122b432c5fd972ec398 5476 utils optional
unzip_6.0-31_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmp6CQgACgkQQc5/C58b
izKmYQf9GAyOSpa9QtLxB4rbsd+oGN1DkpCXDTpg+3433iD8M2fviI0dfWxnWyx8
d+4RKAqu1JUfsbem0Jzi2tUow6lub4BIJrTAJCCIyNzAPc2LpdsTTucJI6zPN+Vj
EPiElIuoTwJcedwE7MXaMDQRTCwp1tiJQr5ojPcu60K8RMLGX0UamCTe3WggF2MC
XxBf9pYiopcc3VsUHIOY/p157KYMuSkd6Y5yMFgy135ASxl+b+54/XAwF04yMmdF
h4eK2JJNb1iwlpzDgfUuytA9SkeeeUKQT0fm6zW+zW2VtvbxI7M6X9Jlsa6q299M
DeziOp5Pmp577jz3xwaqufntgcN9Jw==
=7SFT
-----END PGP SIGNATURE-----
pgplLbwfBmd0a.pgp
Description: PGP signature
--- End Message ---
