CVE-2018-1000035 is a high-severity heap-based buffer overflow vulnerability affecting Info-Zip UnZip versions 6.00 and earlier. This flaw allows an attacker to trigger a denial of service or potentially execute arbitrary code by tricking a user into opening a specially crafted password-protected archive. With a CVSS score of 7.8, the vulnerability has a high impact on confidentiality, integrity, and availability, requiring user interaction but with low attack complexity. Despite its high risk score and potential for code execution, there is currently no public exploit code available, nor is it listed on CISA's KEV catalog, and it has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.00CPE matchmatch criteria | cpe:2.3:a:unzip_project:unzip:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2018-1000035
Jun 11, 2024CVE-2018-1000035
Aug 11, 2020A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.
Feb 13, 2018unzip: Heap-based buffer overflow in fileio.c:UzpPassword function allows code execution
Feb 7, 2018