CVE catalog

CVE-2021-4217

unzip vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 25, 2026

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianunzipsid6.0-31vulnerable
Debianunzipforky6.0-31vulnerable
Debianunziptrixie6.0-29+deb13u1vulnerable
Debianunziptrixie-security6.0-29+deb13u1vulnerable
Debianunzipbookworm6.0-28vulnerable
Debianunzipbookworm-security6.0-28+deb12u1vulnerable
UbuntuunzipnobleNot reportedvulnerable
Ubuntuunzipnoble6.0-28ubuntu4.1fixed
Alpineunzip3.176.0-r11fixed
Alpineunzip3.186.0-r11fixed
Alpineunzip3.196.0-r11fixed
Alpineunzip3.206.0-r11fixed
Alpineunzip3.216.0-r11fixed
Alpineunzip3.226.0-r11fixed
Alpineunzip3.236.0-r11fixed
Alpineunzip3.246.0-r11fixed
Ubuntuunzippro6.0-17ubuntu1vulnerable
Ubuntuunzippro6.0-19ubuntu1vulnerable
Ubuntuunzippro6.0-19ubuntu2vulnerable
Ubuntuunzippro6.0-20ubuntu1vulnerable
Ubuntuunzippro6.0-20ubuntu1.1vulnerable
Ubuntuunzippro6.0-20ubuntu1.1+esm1fixed
Ubuntuunzip18.046.0-21ubuntu1vulnerable
Ubuntuunzip18.046.0-21ubuntu1.1vulnerable
Ubuntuunzip18.046.0-21ubuntu1.2fixed
Ubuntuunzip20.046.0-25ubuntu1vulnerable
Ubuntuunzip20.046.0-25ubuntu1.1fixed
Ubuntuunzip22.046.0-26ubuntu1vulnerable
Ubuntuunzip22.046.0-26ubuntu2vulnerable
Ubuntuunzip22.046.0-26ubuntu3vulnerable
Ubuntuunzip22.046.0-26ubuntu3.1fixed
Ubuntuunzip24.046.0-28ubuntu1vulnerable
Ubuntuunzip24.046.0-28ubuntu2vulnerable
Ubuntuunzip24.046.0-28ubuntu3vulnerable
Ubuntuunzip24.046.0-28ubuntu4vulnerable
Ubuntuunzip24.046.0-28ubuntu4.1fixed
Ubuntuunzippro6.0-17ubuntu1vulnerable
Ubuntuunzippro6.0-19ubuntu1vulnerable
Ubuntuunzippro6.0-19ubuntu2vulnerable
Ubuntuunzippro6.0-20ubuntu1vulnerable
Ubuntuunzippro6.0-20ubuntu1.1vulnerable
Ubuntuunzippro6.0-20ubuntu1.1+esm1fixed
Ubuntuunzip18.046.0-21ubuntu1vulnerable
Ubuntuunzip18.046.0-21ubuntu1.1vulnerable
Ubuntuunzip18.046.0-21ubuntu1.2fixed
Ubuntuunzip20.046.0-25ubuntu1vulnerable
Ubuntuunzip20.046.0-25ubuntu1.1fixed
Ubuntuunzip22.046.0-26ubuntu1vulnerable
Ubuntuunzip22.046.0-26ubuntu2vulnerable
Ubuntuunzip22.046.0-26ubuntu3vulnerable
Ubuntuunzip22.046.0-26ubuntu3.1fixed
Ubuntuunzip24.046.0-28ubuntu1vulnerable
Ubuntuunzip24.046.0-28ubuntu2vulnerable
Ubuntuunzip24.046.0-28ubuntu3vulnerable
Ubuntuunzip24.046.0-28ubuntu4vulnerable
Ubuntuunzip24.046.0-28ubuntu4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianunzipsourcesid(unfixed)unimportantNot reportedNot reported
Debianunzipsourceforky(unfixed)unimportantNot reportedNot reported
Debianunzipsourcetrixie(unfixed)unimportantNot reportedNot reported
Debianunzipsourcebookworm(unfixed)unimportantNot reportedNot reported
Ubuntuunzipdebnoble6.0-28ubuntu4.1Not reportedNot reportedNot reported
Alpineunzipapk3.176.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.186.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.196.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.206.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.216.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.226.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.236.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Alpineunzipapk3.246.0-r11Not reportedALPINE-CVE-2021-4217Not reported
Ubuntuunzipdebpro6.0-20ubuntu1.1+esm1Not reportedUSN-5673-1Not reported
Ubuntuunzipdeb18.046.0-21ubuntu1.2Not reportedUSN-5673-1Not reported
Ubuntuunzipdeb20.046.0-25ubuntu1.1Not reportedUSN-5673-1Not reported
Ubuntuunzipdeb22.046.0-26ubuntu3.1Not reportedUSN-5673-1Not reported
Ubuntuunzipdeb24.046.0-28ubuntu4.1Not reportedUSN-7054-1Not reported
Ubuntuunzipdebpro6.0-20ubuntu1.1+esm1Not reportedUBUNTU-CVE-2021-4217Not reported
Ubuntuunzipdeb18.046.0-21ubuntu1.2Not reportedUBUNTU-CVE-2021-4217Not reported
Ubuntuunzipdeb20.046.0-25ubuntu1.1Not reportedUBUNTU-CVE-2021-4217Not reported
Ubuntuunzipdeb22.046.0-26ubuntu3.1Not reportedUBUNTU-CVE-2021-4217Not reported
Ubuntuunzipdeb24.046.0-28ubuntu4.1Not reportedUBUNTU-CVE-2021-4217Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [unzip]Unknown
    Details (4)

    • 6.0-28 · amd64 · bookworm

      Affected

      usn · unzip · debian · bookworm; usn · unzip · debian · 12

    • 6.0-28 · arm64 · bookworm

      Affected

      usn · unzip · debian · bookworm; usn · unzip · debian · 12

    • 6.0-28+deb12u1 · amd64 · bookworm-security

      Affected

      usn · unzip · debian · bookworm; usn · unzip · debian · 12

    • 6.0-28+deb12u1 · arm64 · bookworm-security

      Affected

      usn · unzip · debian · bookworm; usn · unzip · debian · 12

[Debian 13 (Trixie)]

  • [unzip]Unknown
    Details (4)

    • 6.0-29 · amd64 · trixie

      Affected

      usn · unzip · debian · 13

    • 6.0-29 · arm64 · trixie

      Affected

      usn · unzip · debian · 13

    • 6.0-29+deb13u1 · amd64 · trixie-security

      Affected

      usn · unzip · debian · 13

    • 6.0-29+deb13u1 · arm64 · trixie-security

      Affected

      usn · unzip · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]