| Package | Affected versions | Patched versions |
|---|---|---|
| nanazip | ≥ 5.0.1252.0, < 6.0.1638.0 | 6.0.1638.0 |
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bounds memory access during archive open/listing. The bug is reachable via normal user file-open flow and can cause process crash, hang, and potentially exploitable heap corruption. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free