DSA-6439-1 zip - security update
Harry Sintonen discovered that the Info-ZIP zip program is prone to a command injection vulnerability if a specially crafted filename is processed. https://security-tracker.debian.org/tracker/DSA-6439-1
CSIRTS triage
- What
- A command injection vulnerability in the zip program allows code execution via specially crafted filenames.
- Who is affected
- All users archiving files with untrusted or crafted filenames using affected zip versions.
- Urgency
- High; command injection poses significant risk and warrants prompt patching.
- Action
- Update to the patched version of zip provided by Debian or the upstream Info-ZIP project.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch zip
Get an email when a new zip advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00350.html
More from Debian Security Advisories
- unknownDSA-6443-1 docker.io - security update2026-08-16
- unknownDSA-6444-1 neutron - security update2026-08-16
- unknownDSA-6440-1 unzip - security update2026-08-14
- unknownDSA-6441-1 python-httplib2 - security update2026-08-14
- unknownDSA-6442-1 util-linux - security update2026-08-14