unzip (6.0-21ubuntu1.1+9.0trisquel1) etiona-security; urgency=medium * Compiled for Trisquel -- Trisquel GNU/Linux developers Wed, 16 Dec 2020 18:35:20 +0000 unzip (6.0-21ubuntu1.1) bionic-security; urgency=medium * SECURITY UPDATE: buffer overflow in password protected ZIP archives - debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch: Perform check before allocating memory in fileio.c. - CVE-2018-1000035 * SECURITY UPDATE: denial of service (resource consumption) - debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch: Fix bug in undefer_input() of fileio.c that misplaced the input state. - debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch: Detect and reject a zip bomb using overlapped entries. - debian/patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch: Do not raise a zip bomb alert for a misplaced central directory. - CVE-2019-13232 -- Avital Ostromich Thu, 26 Nov 2020 16:01:36 -0500 unzip (6.0-21ubuntu1) artful; urgency=low * Merge from Debian unstable. Remaining changes: - Add patch from archlinux which adds the -O option, allowing a charset to be specified for the proper unzipping of non-Latin and non-Unicode filenames. -- Steve Langasek Thu, 27 Apr 2017 22:23:23 -0700 unzip (6.0-21) unstable; urgency=medium * Rename all debian/patches/* to have .patch ending. * Update 12-cve-2014-9636-test-compr-eb.patch to follow revised patch "unzip-6.0_overflow3.diff" from mancha (patch author). Update also to follow upstream coding style. * Drop workaround for gcc optimization bug on ARM (GCC Bug #764732) in the hope that it's not present anymore in GCC-6. * Allow source to be cross-built. Closes: #836051. * Do not ignore Unix Timestamps. Closes: #842993. Patch by the author. * Fix CVE-2014-9913, buffer overflow in unzip. Closes: #847485. Patch by the author. * Fix CVE-2016-9844, buffer overflow in zipinfo. Closes: #847486. Patch by the author. -- Santiago Vila Sun, 11 Dec 2016 21:03:30 +0100 unzip (6.0-20ubuntu2) artful; urgency=medium * No-change rebuild to pick up -fPIE compiler default in static libraries -- Steve Langasek Fri, 21 Apr 2017 20:58:49 +0000 unzip (6.0-20ubuntu1) xenial; urgency=medium * Resynchronise with Debian. Remaining changes: - Add patch from archlinux which adds the -O option, allowing a charset to be specified for the proper unzipping of non-Latin and non-Unicode filenames. -- Marc Deslauriers Fri, 20 Nov 2015 09:16:18 -0500 unzip (6.0-20) unstable; urgency=high * Update debian/patches/16-fix-integer-underflow-csiz-decrypted to fix regression on encrypted 0-byte files. Closes: #804595. Thanks to Marc Deslauriers for the fix in Ubuntu. -- Santiago Vila Mon, 09 Nov 2015 22:15:32 +0100 unzip (6.0-19ubuntu2) xenial; urgency=medium * debian/patches/16-fix-integer-underflow-csiz-decrypted: updated to fix regression in handling 0-byte files (LP: #1513293) -- Marc Deslauriers Mon, 09 Nov 2015 08:51:17 -0600 unzip (6.0-19ubuntu1) xenial; urgency=medium * Resynchronise with Debian. Remaining changes: - Add patch from archlinux which adds the -O option, allowing a charset to be specified for the proper unzipping of non-Latin and non-Unicode filenames. -- Sebastien Bacher Fri, 23 Oct 2015 15:58:43 +0200 unzip (6.0-19) unstable; urgency=medium * Fix infinite loop when extracting password-protected archive. This is CVE-2015-7697. Closes: #802160. * Fix heap overflow when extracting password-protected archive. This is CVE-2015-7696. Closes: #802162. * Fix additional unsigned overflow on invalid input. * Thanks a lot to Raphaël Hertzog for the squeeze-lts release, from which this upload is mainly derived. -- Santiago Vila Thu, 22 Oct 2015 12:12:46 +0200 unzip (6.0-18) unstable; urgency=medium * Ship a debian/copyright file in source package instead of generating it a build time. Closes: #795567. -- Santiago Vila Sun, 16 Aug 2015 23:34:42 +0200 unzip (6.0-17) unstable; urgency=medium * Switch to dh. * Remove build date embedded in binary to make the build reproducible. Thanks to Jérémy Bobbio . Closes: #782851. -- Santiago Vila Sun, 17 May 2015 12:41:52 +0200 unzip (6.0-16) unstable; urgency=medium * Update 09-cve-2014-8139-crc-overflow to fix CVE-2014-8139 the right way (patch by the author). Closes: #775640. * Update 10-cve-2014-8140-test-compr-eb to apply cleanly. * Update 12-cve-2014-9636-test-compr-eb to follow the extract.c file from the author. -- Santiago Vila Fri, 30 Jan 2015 22:16:08 +0100 unzip (6.0-15) unstable; urgency=medium * Fix heap overflow. Ensure that compressed and uncompressed block sizes match when using STORED method in extract.c. Patch taken from Ubuntu. Thanks a lot. Closes: #776589. For reference, this is CVE-2014-9636. -- Santiago Vila Thu, 29 Jan 2015 18:39:52 +0100 unzip (6.0-14) unstable; urgency=medium * Drop -O2 optimization on armhf as a workaround for gcc Bug #764732. Closes: #773785. -- Santiago Vila Tue, 30 Dec 2014 22:17:12 +0100 unzip (6.0-13) unstable; urgency=medium * Apply upstream fix for three security bugs. Closes: #773722. CVE-2014-8139: CRC32 verification heap-based overflow CVE-2014-8140: out-of-bounds write issue in test_compr_eb() CVE-2014-8141: out-of-bounds read issues in getZip64Data() -- Santiago Vila Mon, 22 Dec 2014 19:16:10 +0100 unzip (6.0-12) unstable; urgency=medium * Fix zipinfo crash where a value <= 25.5 was printed in a buffer having room only for values < 10.0. The integral part is now printed at attribs[11] using %2u instead of attribs[12] using %u. This way the output is the same as before for values < 10. Authors tell me that the next unzip release will have a fix like this, at least for the Unix case. Closes: #744212. -- Santiago Vila Thu, 24 Apr 2014 23:39:38 +0200 unzip (6.0-11) unstable; urgency=medium * Lowered mime priority to 3, somewhat below 5 which is file-roller default value. Closes: #727306. * Increase size of cfactorstr array in list.c to avoid a buffer overflow problem. Closes: #741384. -- Santiago Vila Mon, 17 Mar 2014 17:38:50 +0100 unzip (6.0-10) unstable; urgency=low * Fixed bug "unzip thinks some files are symlinks". Closes: #717029. Reported by Jeff King. Patch by Andreas Schwab. * Added recommended targets build-arch and build-indep. * Dropped obsolete Conflicts and Replaces on unzip-crypt, for which the last version was a dummy transitional package. * The copyright file is generated from copyright.in at build time. Added lintian override for no-debian-copyright. -- Santiago Vila Mon, 14 Oct 2013 18:48:40 +0200 unzip (6.0-9) unstable; urgency=low * Added NO_WORKING_ISPRINT to DEFINES so that UTF8 filenames are displayed correctly. Reported by Slavek Banko. Closes: #682682. * Use the right strip command when cross-building. Closes: #695141. -- Santiago Vila Sun, 24 Feb 2013 17:12:00 +0100 unzip (6.0-8) unstable; urgency=low * Made unzip -X to actually restore uid/gid information. Closes: #689212. Thanks to Axel Scheepers for the report. * Disabled memcpy, as it is being used on overlapping buffers, leading to data corruption. Closes: #694601. Thanks to M Joonas Pihlaja for the report. -- Santiago Vila Wed, 28 Nov 2012 12:41:34 +0100 unzip (6.0-7) unstable; urgency=low * Added Multi-Arch: foreign. Closes: #678812. -- Santiago Vila Sat, 30 Jun 2012 14:17:42 +0200 unzip (6.0-6) unstable; urgency=low * Added hardening flags. Closes: #656268. -- Santiago Vila Sun, 01 Apr 2012 00:01:40 +0200 unzip (6.0-5) unstable; urgency=low * Handle the PKWare verification bit of internal attributes. Patch taken from 6.10 beta. Thanks to sms. Closes: #630078. -- Santiago Vila Fri, 01 Jul 2011 19:06:08 +0200 unzip (6.0-4) unstable; urgency=low * Added homepage field to control file. * Switch to 3.0 (quilt) source format. * Support cross-build. -- Santiago Vila Sun, 21 Feb 2010 17:01:00 +0100 unzip (6.0-3) unstable; urgency=low * Added "set -e" to postinst and postrm. -- Santiago Vila Tue, 09 Feb 2010 23:53:42 +0100 unzip (6.0-2) unstable; urgency=low * Do not ignore errors from make clean (lintian warning) * Remove .comment section from executables (lintian warning). * Added mime stuff so that mutt is able to see the contents of a zipfile using "unzip -l". Closes: #474538. -- Santiago Vila Mon, 08 Feb 2010 18:44:00 +0100 unzip (6.0-1) unstable; urgency=low * New upstream release. Closes: #496989. * Enabled new Unicode support. Closes: #197427. This may or may not work for your already created zipfiles, but it's not a bug unless they were created using the Unicode feature present in zip 3.0. * Built using DATE_FORMAT=DF_YMD so that unzip -l show dates in ISO format, as that's the only available one which makes sense. Closes: #312886. * Enabled new bzip2 support. Closes: #426798. * Exit code for zipgrep should now be the right one. Closes: #441997. * The reason why a file may not be created is now shown. Closes: #478791. * Summary of changes in this version not being the debian/* files: - Manpages in section 1, not 1L. - Branding patch. UnZip by Debian. Original by Info-ZIP. - Always #include . Debian GNU/kFreeBSD needs it. -- Santiago Vila Fri, 08 May 2009 20:02:40 +0200 unzip (5.52-12) unstable; urgency=medium * Fixed stack underflow in unshrink.c. Closes: #454037. Thanks to Christian Spieler for the patch. -- Santiago Vila Sat, 26 Jul 2008 16:51:38 +0200 unzip (5.52-11) unstable; urgency=high * Apply patch from Tavis Ormandy to address invalid free() calls in the inflate_dynamic() function (CVE-2008-0888). -- Santiago Vila Thu, 20 Mar 2008 17:53:00 +0100 unzip (5.52-10) unstable; urgency=low * Fixed typo in unzipsfx(1). Thanks to Kevin Ryde. Closes: #419479. -- Santiago Vila Mon, 2 Jul 2007 18:08:44 +0200 unzip (5.52-9) unstable; urgency=low * Added appropriate compiler flags for Large File Support (Closes: #192253). This procedure is blessed by upstream in the FAQ, and as a result, some .zip archives may now be uncompressed using Debian unzip. For those which still may not, please test unzip 6.0 beta. -- Santiago Vila Wed, 30 Aug 2006 10:34:24 +0200 unzip (5.52-8) unstable; urgency=low * Modified unix/unxcfg.h to always #include . This should now work on GNU/kFreeBSD (Closes: #340693). -- Santiago Vila Tue, 25 Apr 2006 19:50:24 +0200 unzip (5.52-7) unstable; urgency=medium * Fixed buffer overflow when insanely long filenames are given on the command line. Patch from Johnny Lee. Changed some format strings so that they use 512 characters at most. The "right" fix will be in 5.53, but this should work well enough for now. Closes: #349794. * This is CVE-2005-4667. -- Santiago Vila Thu, 16 Mar 2006 10:31:20 +0100 unzip (5.52-6) unstable; urgency=medium * Symlinks should work again (Closes: #343680). Fix provided by Christian Spieler. Thanks to Carl W. Hoffman for the report. -- Santiago Vila Tue, 20 Dec 2005 19:18:32 +0100 unzip (5.52-5) unstable; urgency=low * Fixed CAN-2005-2475 the same way it will be fixed in unzip 5.53. Patch extracted from a prerelease provided by upstream. * Changed unzip banner line to reflect the fact that this is a "modified" release. Debian-derived distributions should probably do the same if they deviate from the Debian version. -- Santiago Vila Thu, 17 Nov 2005 16:34:24 +0100 unzip (5.52-4) unstable; urgency=medium * Fixed toctou vulnerability (Closes: #321927). Modified unix/unix.c to use fchmod() and fchown() instead of chmod() and chown() to change permissions and ownerships on the files actually created by unzip. Patch from Dan Yefimov. CAN-2005-2475. -- Santiago Vila Wed, 9 Nov 2005 18:05:02 +0100 unzip (5.52-3) unstable; urgency=low * Put manpages in section 1, not 1L. * Fixed more typos (Closes: #309885). -- Santiago Vila Wed, 25 May 2005 16:09:02 +0200 unzip (5.52-2) unstable; urgency=low * Fixed typos in manpage (Closes: #301915). -- Santiago Vila Sun, 24 Apr 2005 19:27:02 +0200 unzip (5.52-1) unstable; urgency=low * New upstream release. * Enabled new -W option via WILD_STOP_AT_DIR macro. * Macro USE_UNSHRINK is no longer defined, as it's now the default. -- Santiago Vila Tue, 1 Mar 2005 15:33:54 +0100 unzip (5.51-2) unstable; urgency=low * Added unshrinking support (Closes: #252563). -- Santiago Vila Sun, 6 Jun 2004 17:57:46 +0200 unzip (5.51-1) unstable; urgency=low * New upstream release, improves error message when a zipfile is not readable (Closes: #139331). * Added a newline character to the CannotOpenZipfile string for the previous fix to be really complete. -- Santiago Vila Tue, 25 May 2004 14:38:26 +0200 unzip (5.50-4) unstable; urgency=low * Changed __GNU__ to __GLIBC__ in unix/unxcfg.h to support glibc-based systems not being GNU itself, like GNU/KFreeBSD and GNU/KNetBSD. -- Santiago Vila Sun, 16 Nov 2003 14:45:28 +0100 unzip (5.50-3) unstable; urgency=high * Fixed "unzip directory traversal revisited" again (Bug #206439). There was still a missing case that the previous patch didn't catch. Patch borrowed from unzip-5.50-33.src.rpm. * For reference, this is (still) CAN-2003-0282. -- Santiago Vila Wed, 20 Aug 2003 23:00:42 +0200 unzip (5.50-2) unstable; urgency=high * Fixed "unzip directory traversal revisited" problem (Bug #199648). A filename containing ".somenonprintablechar." will not unpack into .. anymore. Patch borrowed from unzip-5.50-11.src.rpm. * For reference, this is CAN-2003-0282. * No more doc symlinks. -- Santiago Vila Mon, 7 Jul 2003 20:25:20 +0200 unzip (5.50-1) unstable; urgency=low * New upstream release. * Moved from non-US/main to main. Section: utils. -- Santiago Vila Sun, 24 Mar 2002 15:54:12 +0100 unzip (5.42-3) unstable; urgency=low * Added support for DEB_BUILD_OPTIONS. -- Santiago Vila Sun, 11 Nov 2001 16:25:00 +0100 unzip (5.42-2) unstable; urgency=low * Applied a patch from Marcus Brinkmann: - Closes: #99699: unzip does not build on the Hurd. - Modified debian/rules to support cross-compilation. -- Santiago Vila Wed, 6 Jun 2001 16:40:14 +0200 unzip (5.42-1) unstable; urgency=low * New upstream release. * Changed to Section: non-US. * Removed "packaged for Debian" from extended description. -- Santiago Vila Thu, 10 May 2001 16:47:41 +0200 unzip (5.41-1) unstable; urgency=low * New upstream release, featuring a new BSD-like license and built-in encryption support. Moved to non-US/main. * Copyright file now generated from LICENSE file. * Versioned Conflicts and Replaces. * Standards-Version: 3.1.1 -- Santiago Vila Fri, 18 Aug 2000 19:03:59 +0200 unzip (5.40-1) unstable; urgency=low * New upstream release. * Removed `email-from-greg'. * Fixed URL location in copyright file. * Enabled -F option, as suggested by James Aylett. -- Santiago Vila Fri, 22 Oct 1999 10:30:49 +0200 unzip (5.32-1) unstable; urgency=low * New upstream release, using pristine source. -- Santiago Vila Tue, 4 Nov 1997 14:19:20 +0100 unzip (5.31-2) unstable; urgency=low * Removed debstd dependency. -- Santiago Vila Fri, 17 Oct 1997 17:22:22 +0200 unzip (5.31-1) unstable; urgency=low * `copyright' file is generated from COPYING automatically. * Distribution unstable, Section non-free. * Conflicts and Replaces "unzip-crypt". * New upstream release. * First libc6 release. * Added md5sums. -- Santiago Vila Fri, 12 Sep 1997 19:16:59 +0200 unzip (5.20-3) unstable; urgency=low * Changed priority from `extra' to `optional'. * Changed section from `misc' to `utils'. * Simplified debian/rules a little bit. No debstd yet. * Copied `History.520' as is. Added the symlink changelog -> History.520. * Added ToDo and BUGS to /usr/doc/unzip. * New maintainer. -- Santiago Vila Sun, 16 Feb 1997 19:29:13 +0100 unzip (5.20-2) unstable; urgency=low * zipgrep manpage is now installed through the unix/Makefile * permissions guaranteed to be set properly for the zipgrep script (did not work for those who compiled from the straight sources.) * removed several superfluous commands from debian/rules. * All changes this revision are courtesy of Santiago Vila. -- Stuart Lamble Wed, 8 Jan 1997 18:48:00 +1100 unzip (5.20-1) unstable; urgency=low * new upstream version * modified the copyright to include 5.2's COPYING, just in case it's changed. * minor modifications to debian/rules * added zipgrep (from the zip package). -- Stuart Lamble Wed, 13 Nov 1996 19:35:24 +1100 unzip (5.12-15) unstable; urgency=low * received email from the upstream maintainers: unzip can now go into the distribution proper. Yippee! :-) * added the email in question to the copyright file. -- Stuart Lamble Sat, 19 Oct 1996 18:34:21 +1000 unzip (5.12-14) non-free; urgency=low * moved to the 2.1.1.0 source format * fixed a typo in the Maintainer field (missing the ">". Oops.) -- Stuart Lamble Sun, 1 Sep 1996 07:36:16 +1000 unzip (5.12-13) non-free; urgency=low * new maintainer * mods to make the "binary" rule portable to different platforms * uses dpkg-name rather than manual moving -- Stuart Lamble Tue, 30 Jul 1996 00:00:00 +0000 unzip (5.12-12) non-free; urgency=low * initial release (used 2 to avoid confusion with old unzip) -- Carl Streeter Tue, 5 Sep 1995 00:00:00 +0000