Version in base suite: 6.0-29 Base version: unzip_6.0-29 Target version: unzip_6.0-29+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/u/unzip/unzip_6.0-29.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/u/unzip/unzip_6.0-29+deb13u1.dsc changelog | 11 +++++ patches/can-2026-2034440.patch | 89 +++++++++++++++++++++++++++++++++++++++++ patches/can-2026-2034442.patch | 31 ++++++++++++++ patches/can-2026-2034443.patch | 21 +++++++++ patches/series | 3 + 5 files changed, 155 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxabqoirl/unzip_6.0-29.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpxabqoirl/unzip_6.0-29+deb13u1.dsc: no acceptable signature found diff -Nru unzip-6.0/debian/changelog unzip-6.0/debian/changelog --- unzip-6.0/debian/changelog 2025-03-11 15:40:00.000000000 +0000 +++ unzip-6.0/debian/changelog 2026-08-10 22:10:00.000000000 +0000 @@ -1,3 +1,14 @@ +unzip (6.0-29+deb13u1) trixie-security; urgency=high + + * Apply upstream fix for CAN-2026-2034440. Closes: #1142904. + (heap out-of-bounds read in EF_IZUNIX3 extra field handler) + * Apply upstream fix for CAN-2026-2034443. Closes: #1142905. + (stack out-of-bounds NUL write in EF_SMARTZIP handler) + * Apply upstream fix for CAN-2026-2034442. Closes: #1142906. + (heap buffer overflow WRITE in memextract() STORED path) + + -- Santiago Vila Tue, 11 Aug 2026 00:10:00 +0200 + unzip (6.0-29) unstable; urgency=medium * Ignore invalid "Total number of disks" field on Microsoft ZIP64 files. diff -Nru unzip-6.0/debian/patches/can-2026-2034440.patch unzip-6.0/debian/patches/can-2026-2034440.patch --- unzip-6.0/debian/patches/can-2026-2034440.patch 1970-01-01 00:00:00.000000000 +0000 +++ unzip-6.0/debian/patches/can-2026-2034440.patch 2026-08-10 22:10:00.000000000 +0000 @@ -0,0 +1,89 @@ +From: Paul Marquess +Subject: Fix heap out-of-bounds read in EF_IZUNIX3 extra field handler [CAN-2026-2034440] +Bug-Debian: https://bugs.debian.org/1142904 +X-Debian-version: 6.0-30 + +--- a/process.c ++++ b/process.c +@@ -2987,7 +2987,7 @@ + have_new_type_eb = 2; + + /* Ignore any prior EF_IZUNIX/EF_PKUNIX/EF_IZUNIX2 UID/GID. */ +- flags &= 0x0ff; ++ flags &= EB_UT_FL_TIMES; + /* + Version 1 byte version of this extra field, currently 1 + UIDSize 1 byte Size of UID field +@@ -2995,29 +2995,46 @@ + GIDSize 1 byte Size of GID field + GID Variable GID for this entry + */ +- +-#ifdef IZ_HAVE_UXUIDGID +- if (eb_len >= EB_UX3_MINLEN +- && z_uidgid != NULL +- && (*((EB_HEADSIZE + 0) + ef_buf) == 1)) +- /* only know about version 1 */ ++# ifdef IZ_HAVE_UXUIDGID ++ /* Check for a legitimate extra block length, a non-NULL ++ * destination pointer, and "ux" version 1 (which is all we ++ * understand). ++ */ ++ if ((eb_len >= EB_UX3_MINLEN) && ++ (z_uidgid != NULL) && ++ (*((EB_HEADSIZE + 0) + ef_buf) == 1)) + { +- uch uid_size; +- uch gid_size; ++ /* 2012-12-07 SMS. (OUSPG report.) ++ * First, clear "flags". Then, check the validity of ++ * uid_size before using it to find gid_size. ++ * Made Xid_size bigger than "uch" for safer arithmetic. ++ */ ++ unsigned uid_size; ++ unsigned gid_size; + + uid_size = *((EB_HEADSIZE + 1) + ef_buf); +- gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); + +- if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf, +- uid_size, &z_uidgid[0]) +- && +- read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf, +- gid_size, &z_uidgid[1]) ) ++ /* Valid: 1 (Version) + 1 (UIDSize) + UIDSize + ++ * 1 (GIDSize) + 2 (min GIDSize) <= eb_len. ++ */ ++ if (5+ uid_size <= eb_len) + { +- flags |= EB_UX2_VALID; /* signal success */ ++ gid_size = *((EB_HEADSIZE + uid_size + 2) + ef_buf); ++ ++ /* Last, check total claimed xID sizes against eb_len. */ ++ if (3+ uid_size+ gid_size == eb_len) ++ { ++ if (read_ux3_value( (EB_HEADSIZE + 2) + ef_buf, ++ uid_size, &z_uidgid[0]) && ++ read_ux3_value( (EB_HEADSIZE + uid_size + 3) + ef_buf, ++ gid_size, &z_uidgid[1])) ++ { ++ flags |= EB_UX2_VALID; /* signal success */ ++ } ++ } + } + } +-#endif /* IZ_HAVE_UXUIDGID */ ++# endif /* def IZ_HAVE_UXUIDGID */ + break; + + case EF_IZUNIX: +--- a/unzpriv.h ++++ b/unzpriv.h +@@ -1788,6 +1788,7 @@ + #define EB_UT_FL_MTIME (1 << 0) /* mtime present */ + #define EB_UT_FL_ATIME (1 << 1) /* atime present */ + #define EB_UT_FL_CTIME (1 << 2) /* ctime present */ ++# define EB_UT_FL_TIMES 0xff /* Mask for all time flag bits. */ + + #define EB_FLGS_OFFS 4 /* offset of flags area in generic compressed + extra field blocks (BEOS, MAC, and others) */ diff -Nru unzip-6.0/debian/patches/can-2026-2034442.patch unzip-6.0/debian/patches/can-2026-2034442.patch --- unzip-6.0/debian/patches/can-2026-2034442.patch 1970-01-01 00:00:00.000000000 +0000 +++ unzip-6.0/debian/patches/can-2026-2034442.patch 2026-08-10 22:10:00.000000000 +0000 @@ -0,0 +1,31 @@ +From: Paul Marquess +Subject: Fix heap buffer overflow WRITE in memextract() STORED path +Bug-Debian: https://bugs.debian.org/1142906 +X-Debian-version: 6.0-31 + +--- a/extract.c ++++ b/extract.c +@@ -2520,6 +2520,10 @@ + + switch (method) { + case STORED: ++ if ((extent)G.incnt > tgtsize) { ++ error = PK_ERR; ++ break; ++ } + memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt); + G.outcnt = (ulg)G.csize; /* for CRC calculation */ + break; +@@ -2657,8 +2661,10 @@ + decompress_bits(ucdata, usiz, ebdata+EB_IZVMS_HLEN); + break; + case EB_IZVMS_BCDEFL: +- memextract(__G__ ucdata, (ulg)usiz, +- ebdata+EB_IZVMS_HLEN, (ulg)csiz); ++ if (memextract(__G__ ucdata, (ulg)usiz, ebdata+EB_IZVMS_HLEN, (ulg)csiz) != PK_OK) { ++ free(ucdata); ++ ucdata = NULL; ++ } + break; + default: + free(ucdata); diff -Nru unzip-6.0/debian/patches/can-2026-2034443.patch unzip-6.0/debian/patches/can-2026-2034443.patch --- unzip-6.0/debian/patches/can-2026-2034443.patch 1970-01-01 00:00:00.000000000 +0000 +++ unzip-6.0/debian/patches/can-2026-2034443.patch 2026-08-10 22:10:00.000000000 +0000 @@ -0,0 +1,21 @@ +From: Paul Marquess +Subject: Fix stack out-of-bounds NUL write in EF_SMARTZIP handler [CAN-2026-2034443] +Bug-Debian: https://bugs.debian.org/1142905 +X-Debian-version: 6.0-30 + +--- a/zipinfo.c ++++ b/zipinfo.c +@@ -1702,9 +1702,12 @@ + if ((eb_datalen == EB_SMARTZIP_HLEN) && + makelong(ef_ptr) == 0x70695A64 /* "dZip" */) { + char filenameBuf[32]; ++ int filename_length = ef_ptr[32] ; + zi_showMacTypeCreator(__G__ &ef_ptr[4]); + memcpy(filenameBuf, &ef_ptr[33], 31); +- filenameBuf[ef_ptr[32]] = '\0'; ++ if (filename_length > 31) ++ filename_length = 31; ++ filenameBuf[filename_length] = '\0'; + A_TO_N(filenameBuf); + Info(slide, 0, ((char *)slide, + LoadFarString(ZipItFname), filenameBuf)); diff -Nru unzip-6.0/debian/patches/series unzip-6.0/debian/patches/series --- unzip-6.0/debian/patches/series 2025-03-11 15:40:00.000000000 +0000 +++ unzip-6.0/debian/patches/series 2026-08-10 22:10:00.000000000 +0000 @@ -29,3 +29,6 @@ 29-handle-windows-zip64-files.patch 30-drop-conflicting-declarations.patch 31-fix-zipgrep.patch +can-2026-2034440.patch +can-2026-2034443.patch +can-2026-2034442.patch