CVE-2015-1315

What it actually does

Buffer overflow in charset_to_intern during CP866 to UTF-8 conversion allows memory corruption and arbitrary code execution when processing a crafted string in Info-Zip UnZip 6.10b.

Why it matters to the business

Compromised systems could allow attackers to run unauthorized code, risking data theft, system takeover, or further network access on any environment still using this decades-old unzip version.

How an attack unfolds

An attacker crafts a string or ZIP entry using CP866 encoding that overflows the buffer on conversion to UTF-8; the malformed input is fed to unzip, triggering the overflow and allowing shellcode execution with the privileges of the unzip process.

How to fix it

Replace Info-Zip UnZip 6.10b with a current maintained implementation such as the unzip package from a modern Linux distribution or an alternative tool; remove or isolate any remaining 6.10b binaries.

How to confirm the fix worked

Run 'unzip -v' to confirm the installed version is newer than 6.10b; test extraction of sample archives containing non-UTF-8 strings in an isolated environment to verify absence of crashes or overflows.

Typical attack path

1. Identify target using vulnerable UnZip 6.10b
2. Craft malicious string or ZIP file containing CP866-encoded data
3. Deliver the input via file, archive, or command-line argument
4. Trigger charset conversion in unix/unix.c
5. Exploit resulting memory corruption for code execution

How to detect it

Search process execution logs and command histories for unzip invocations involving non-standard encodings; examine crash reports or core dumps mentioning charset_to_intern or unix/unix.c.

What your security team should do

• Inventory all systems for presence of unzip 6.10b or older
• Block or sandbox execution of legacy unzip binaries
• Replace with supported archive tools across the environment
• Add unzip version checks to build and deployment pipelines