CVE-2005-4667
3.7 · LOWBuffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument.
Overview
CVE-2005-4667 is a low-severity vulnerability affecting info-zip unzip. It was published on December 31, 2005 and has a CVSS 2.0 base score of 3.7 (LOW).
This vulnerability has a CVSS 2.0 base score of 3.7, rated LOW. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
Technical description
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Remediation
Check the references section for vendor advisories and patches from info-zip. Update unzip to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2005-4667?
CVE-2005-4667 is a low-severity vulnerability affecting info-zip unzip. It was published on December 31, 2005 and has a CVSS 2.0 base score of 3.7 (LOW).
How severe is CVE-2005-4667?
This vulnerability has a CVSS 2.0 base score of 3.7, rated LOW. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2005-4667?
Check the references section for vendor advisories and patches from info-zip. Update unzip to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2005-4667?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2005-4667 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related LOW CVEs from 2005
View all- 3.7CVE-2005-0254
BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading o
View details - 3.7CVE-2005-0953
Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary file
View details - 3.7CVE-2005-0988
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local us
View details - 3.7CVE-2005-1039
Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is runn
View details - 3.7CVE-2005-1751
Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files vi
View details - 3.7CVE-2005-1727
Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the (1) s
View details - 3.7CVE-2005-1993
Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry i
View details - 3.7CVE-2005-1768
Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before
View details - 3.7CVE-2005-2306
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun
View details - 3.7CVE-2005-4268
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local us
View details - 3.7CVE-2005-4780
Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote att
View details - 3.6CVE-2004-1066
The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3, and (2) linprocfs on FreeBSD 5.x t
View details