CVE-2016-9844 - Vulnerability Details - OpenCVE

Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0855.

Key SSVC decision points have not yet been added.

Vendors	Products
Unzip Project	Unzip

Configuration 1 [-]

cpe:2.3:a:unzip_project:unzip:6.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-741-1	unzip security update
EUVD	EUVD-2016-10644	Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.
Ubuntu USN	USN-4672-1	unzip vulnerabilities

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2016/12/05/13
http://www.openwall.com/lists/oss-security/2016/12/05/19
http://www.openwall.com/lists/oss-security/2016/12/05/20
http://www.securityfocus.com/bid/94728
https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750
https://nvd.nist.gov/vuln/detail/CVE-2016-9844
https://www.cve.org/CVERecord?id=CVE-2016-9844

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.10185}`	epss `{'score': 0.10974}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-01-18T17:00:00

Updated: 2024-08-06T02:59:03.461Z

Reserved: 2016-12-05T00:00:00

Link: CVE-2016-9844

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-01-18T17:59:01.373

Modified: 2025-04-20T01:37:25.860

Link: CVE-2016-9844

Redhat

Severity : Low

Publid Date: 2016-12-05T00:00:00Z

Links: CVE-2016-9844 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-12-05T00:00:00", "descriptions": [{"lang": "en", "value": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-01-19T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "94728", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94728"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13"}, {"name": "[oss-security] 20161205 Re: CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-9844", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "94728", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94728"}, {"name": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13"}, {"name": "[oss-security] 20161205 Re: CVE Request: Info-Zip zipinfo buffer overflow", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:59:03.461Z"}, "title": "CVE Program Container", "references": [{"name": "94728", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94728"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19"}, {"name": "[oss-security] 20161205 CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13"}, {"name": "[oss-security] 20161205 Re: CVE Request: Info-Zip zipinfo buffer overflow", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-9844", "datePublished": "2017-01-18T17:00:00", "dateReserved": "2016-12-05T00:00:00", "dateUpdated": "2024-08-06T02:59:03.461Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unzip_project:unzip:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "4C9BC86B-F353-4390-B288-B528BA8AA0A1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer en la funci\u00f3n zi_short en zipinfo.c en Info-Zip UnZip 6.0 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda) a trav\u00e9s de un valor de m\u00e9todo de compresi\u00f3n grande en el encabezado del archivo de directorio central."}], "id": "CVE-2016-9844", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-01-18T17:59:01.373", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94728"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94728"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}