CVE-2015-7696

What it actually does

Heap-based buffer over-read in Info-ZIP UnZip 6.0 triggered by a crafted password-protected ZIP archive containing an invalid Extra-Field size value, resulting in application crash or potential arbitrary code execution.

Why it matters to the business

Processing untrusted ZIP files on Linux systems can cause unzip tools to crash, interrupting archive extraction workflows, or allow attackers to execute code and compromise affected hosts.

How an attack unfolds

An attacker crafts a password-protected ZIP archive with a manipulated Extra-Field size, then delivers the file to a target. When the victim extracts it using UnZip 6.0, the buffer over-read occurs during password handling, potentially leading to a crash or code execution.

How to fix it

Upgrade UnZip to a version newer than 6.0 that resolves the Extra-Field handling flaw. If no update is available for a given distribution, replace the utility with a modern alternative such as 7-Zip or bsdtar and avoid extracting untrusted password-protected archives.

How to confirm the fix worked

Confirm the installed UnZip version is newer than 6.0, then test extraction of known-good and crafted archives in a lab environment to verify absence of crashes or unexpected behavior.

Typical attack path

1. Craft a malicious password-protected ZIP with oversized or invalid Extra-Field data
2. Deliver the archive via email, download, or shared storage
3. Victim opens or extracts the archive using vulnerable UnZip 6.0
4. Trigger heap over-read during password verification and extra-field parsing
5. Achieve denial of service via crash or attempt arbitrary code execution

How to detect it

Review system and application logs for UnZip segmentation faults or heap-related errors when processing ZIP files; correlate with file creation or download events involving password-protected archives.

What your security team should do

• Identify all systems running UnZip 6.0 and prioritize upgrade or replacement
• Block or sandbox processing of untrusted ZIP archives until remediated
• Add UnZip crash events to security monitoring for early detection of exploitation attempts