sionnx/cve-2003-0282Portable zipfile extraction utility with broad OS support, decryption, and security fixes for path traversal and symlink vulnerabilities.
This is the README file for the 22 May 2004 public release of the Info-ZIP group's portable UnZip zipfile-extraction program (and related utilities).
unzip551.zip portable UnZip, version 5.51, source code distribution unzip551.tar.Z same as above, but compress'd tar format unzip551.tar.gz same as above, but gzip'd tar format
BEFORE YOU ASK: UnZip, its companion utility Zip, and related utilities and support files can be found in many places; read the file "WHERE" for further details. To contact the authors with suggestions, bug reports, or fixes, continue reading this file (README) and, if this is part of a source distribution, the file "ZipPorts" in the proginfo directory. Also in source distributions: read "BUGS" for a list of known bugs, non-bugs and possible future bugs; INSTALL for instructions on how to build UnZip; and "Contents" for a commented listing of all the distributed files.
UnZip is an extraction utility for archives compressed in .zip format (also called "zipfiles"). Although highly compatible both with PKWARE's PKZIP and PKUNZIP utilities for MS-DOS and with Info-ZIP's own Zip program, our primary objectives have been portability and non-MSDOS functionality.
This version of UnZip has been ported to a stupendous array of hardware-- from micros to supercomputers--and operating systems: Unix (many flavors), VMS, OS/2 (including DLL version), Windows NT and Windows 95 (including DLL version), Windows CE (GUI version), Windows 3.x (including DLL version), MS-DOS, AmigaDOS, Atari TOS, Acorn RISC OS, BeOS, Macintosh (GUI version), SMS/QDOS, MVS, VM/CMS, FlexOS, Tandem NSK, Human68k (mostly), AOS/VS (partly) and TOPS-20 (partly). UnZip features not found in PKUNZIP include source code; default extraction of directory trees (with a switch to defeat this, rather than the reverse); system-specific extended file attributes; and, of course, the ability to run under most of your favorite operating systems. Plus, it's free. :-)
For source distributions, see the main Contents file for a list of what's included, and read INSTALL for instructions on compiling (including OS- specific comments). The individual operating systems' Contents files (for example, vms/Contents) may list important compilation info in addition to explaining what files are what, so be sure to read them. Some of the ports have their own, special README files, so be sure to look for those, too.
See unzip.1 or unzip.txt for usage (or the corresponding UnZipSFX, ZipInfo, fUnZip and ZipGrep docs). For VMS, unzip_def.rnh or unzip_cli.help may be compiled into unzip.hlp and installed as a normal VMS help entry; see vms/descrip.mms.
The 5.51 maintenance release adds a command-line CE port, intended for batch processing. With the integration of this port, the pUnZip port has been revised and "revitalized". The most important changes for the general public are a number of bug fixes, mostly related to security issues:
The main addition in the 5.5 release is support for PKWARE's new Deflate64(tm) algorithm, which appeared first in PKZIP 4.0 (published November 2000). As usual, some other bugfixes and clean-ups have been integrated:
The 5.42 maintenance release fixes more bugs and cleans up the redistribution conditions:
The 5.41 maintenance release adds another new port and fixes some bugs.
The 5.4 release adds new ports, again. Other important items are changes to the listing format, new supplemental features and several bug fixes (especially concerning time-stamp handling...):
The 5.32 release adds two new ports and a fix for at least one relatively serious bug:
The 5.31 release included nothing but small bug-fixes and typo corrections, with the exception of some minor performance tweaks.
The 5.3 release added still more ports and more cross-platform portability features:
What is (still!) not added is multi-part archive support (a.k.a. "diskette spanning") and a unified and more powerful DLL interface. These are the two highest priorities for the 6.x releases. Work on the former is almost certain to have commenced by the time you read this. This time we mean it! You betcha. :-)
