CVE-2022-0530 Vulnerability Details

Record summary

CVE-2022-0530 has a selected CVSS score of 5.5 (medium); EIP currently links 2 repository PoCs and 2 lab environments.

Description

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

Description source: CVE List

Exploitation context

Available material

Repository PoCs: 2
Lab environments: 2

Affected products and versions

Product	Source	Version range	Status
unzip	CVE List	6.0	affected

Proofs of concept

Repository PoCs

GitHubnanaao/unzip_pocRepository PoCby nanaao2Not analyzed14 files

318.8 KiB · linked to 2 vulnerabilities

GitHub

PoC details

GitHubByteHackr/unzip_pocRepository PoCby ByteHackr3Not analyzed14 files

319.2 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Docker lab environments

GitHub

CVE-2022-0530

ByteHackr/unzip_pocCreated 2022-02-28Vuln labCVE-2022-0530Standalone Multiple Dockerfiles

2 Dockerfiles

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

Two Dockerfiles (Fedora 35 and Ubuntu 20.04) that install unzip with debug symbols and valgrind, plus reproduction scripts that mount a testcase zip and run valgrind unzip, then drop into a shell. The README describes a SIGSEGV null-pointer dereference in unzip's utf8-to-local-string conversion.

CVE-2022-0530/Dockerfile-fedora:1-4CVE-2022-0530/Dockerfile-ubuntu:1-11CVE-2022-0530/reproduce-fedora.sh:1-14CVE-2022-0530/reproduce-ubuntu.sh:1-14CVE-2022-0530/README.txt:1-20

Lab assessment

Vulnerability lab

The unit is named CVE-2022-0530, the README describes a specific crash (SIGSEGV, null-pointer dereference) in unzip, provides a testcase, and includes Dockerfiles and scripts to reproduce the crash under valgrind. This is a classic vulnerability reproduction environment.

CVE-2022-0530/README.txt:1-20CVE-2022-0530/reproduce-fedora.sh:1-14

Lab shapeStandalone Multiple Dockerfiles

ServicesUnknown

Compose manifests0

Dockerfiles2

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Dockerfile-fedora

builds Fedora 35 container with unzip and debug tools

Starts from fedora:35, installs yum-utils, valgrind, unzip, and unzip debuginfo.

CVE-2022-0530/Dockerfile-fedora:1-4

Dockerfile-ubuntu

builds Ubuntu 20.04 container with unzip and debug symbols

Starts from ubuntu:20.04, sets DEBIAN_FRONTEND noninteractive, adds Ubuntu debug symbol repositories and keys, installs valgrind, libbz2-1.0-dbgsym, and unzip-dbgsym.

CVE-2022-0530/Dockerfile-ubuntu:1-11

reproduce-fedora.sh

builds Fedora image and reproduces crash

Builds the fedora image, runs valgrind unzip on the mounted testcase, then drops into a bash shell with the testcase available.

CVE-2022-0530/reproduce-fedora.sh:1-14

reproduce-ubuntu.sh

builds Ubuntu image and reproduces crash

Builds the ubuntu image, runs valgrind unzip on the mounted testcase, then drops into a bash shell with the testcase available.

CVE-2022-0530/reproduce-ubuntu.sh:1-14

testcase

malformed zip input that triggers the crash

A binary file (uninspected) that is mounted into the containers as /testcase and processed by unzip to trigger the SIGSEGV.

CVE-2022-0530/README.txt:5-7CVE-2022-0530/reproduce-fedora.sh:8-9

README.txt

documents the vulnerability and reproduction steps

Describes the null-pointer dereference in unzip's utf8_to_local_string, provides valgrind output from both distros, and references the reproduction scripts.

CVE-2022-0530/README.txt:1-20

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-0530

Supported by supplied evidence

The README explicitly describes a SIGSEGV null-pointer dereference in unzip during utf-8 to local string conversion, matching the CVE-2022-0530 identifier in the unit path. The valgrind output shows an invalid read of size 8 at address 0x0 in functions related to string conversion (wide_to_local_string, utf8_to_local_string, do_string).

CVE-2022-0530/README.txt:1-20CVE-2022-0530/README.txt:48-80CVE-2022-0530/README.txt:110-140

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed and the user must have permission to run docker commands.CVE-2022-0530/reproduce-fedora.sh:6-7
The testcase file must be present in the same directory as the scripts.CVE-2022-0530/reproduce-fedora.sh:8-9

Evidence-described exercise path

Run reproduce-fedora.sh or reproduce-ubuntu.sh to build the Docker image and execute valgrind unzip on the testcase, observing the crash.CVE-2022-0530/reproduce-fedora.sh:1-14CVE-2022-0530/reproduce-ubuntu.sh:1-14
Optionally, after the crash, the script drops into a bash shell inside the container for further investigation.CVE-2022-0530/reproduce-fedora.sh:12-14

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfiles only install debugging tools and unzip from official repositories. The scripts mount a local testcase read-only and run valgrind unzip, then offer an interactive shell. No network services are exposed, no privileged mode is used, no host files are written, and no external connections are made beyond the initial apt/dnf package installation during build. The behavior is entirely contained within the lab's purpose of demonstrating a crash in unzip.

CVE-2022-0530/Dockerfile-fedora:1-4CVE-2022-0530/Dockerfile-ubuntu:1-11CVE-2022-0530/reproduce-fedora.sh:8-14

Review boundaries

What the analysis did not establish

The testcase binary is uninspected; its exact structure and whether it contains any payload beyond triggering the crash is unknown.
The repository claims association with both CVE-2022-0529 and CVE-2022-0530, but only CVE-2022-0530 is present in the unit path and evidence; CVE-2022-0529 is not assessed.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2022-0530

nanaao/unzip_pocCreated 2022-02-28Vuln labCVE-2022-0530Standalone Multiple Dockerfiles

2 Dockerfiles

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

Two Dockerfiles (Fedora 35 and Ubuntu 20.04) that install unzip with debug symbols and valgrind, plus reproduction scripts and a malformed testcase, to demonstrate a null-pointer dereference crash in unzip.

CVE-2022-0530/Dockerfile-fedora:1-4CVE-2022-0530/Dockerfile-ubuntu:1-11CVE-2022-0530/README.txt:1-5

Lab assessment

Vulnerability lab

The README describes a null-pointer dereference in unzip, provides a crashing testcase, and includes Docker-based reproduction scripts. The Dockerfiles install debugging tools (valgrind, debug symbols) specifically to observe the crash, which is consistent with a vulnerability research environment.

CVE-2022-0530/README.txt:1-5CVE-2022-0530/README.txt:7-12CVE-2022-0530/README.txt:17-19

Lab shapeStandalone Multiple Dockerfiles

ServicesUnknown

Compose manifests0

Dockerfiles2

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Dockerfile-fedora

builds Fedora 35 container with unzip and debugging tools

Starts from fedora:35, installs yum-utils, valgrind, and unzip, then runs debuginfo-install for unzip to provide debug symbols.

CVE-2022-0530/Dockerfile-fedora:1-4

Dockerfile-ubuntu

builds Ubuntu 20.04 container with unzip and debugging tools

Starts from ubuntu:20.04, sets noninteractive frontend, installs lsb-core, dbgsym keyring, debian-goodies, adds Ubuntu debug symbol repository, and installs valgrind, libbz2-1.0-dbgsym, and unzip-dbgsym.

CVE-2022-0530/Dockerfile-ubuntu:1-11

reproduce-fedora.sh

automates Fedora-based crash reproduction

Builds the Fedora Docker image, runs unzip on the testcase under valgrind, then drops into a shell with the testcase mounted read-only.

CVE-2022-0530/reproduce-fedora.sh:1-14

reproduce-ubuntu.sh

automates Ubuntu-based crash reproduction

Builds the Ubuntu Docker image, runs unzip on the testcase under valgrind, then drops into a shell with the testcase mounted read-only.

CVE-2022-0530/reproduce-ubuntu.sh:1-14

testcase

malformed zip archive triggering the null-pointer dereference

A binary file (uninspected) that is mounted into the containers and passed to unzip to cause a segmentation fault.

CVE-2022-0530/README.txt:3-5CVE-2022-0530/reproduce-fedora.sh:8-9

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-0530

Supported by supplied evidence

The README describes a null-pointer dereference in unzip during UTF-8 to local string conversion, and the valgrind output shows an invalid read of size 8 at address 0x0 in functions related to that conversion, matching the CVE description.

CVE-2022-0530/README.txt:1-12CVE-2022-0530/README.txt:47-60CVE-2022-0530/README.txt:103-116

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed and running on the host to build images and run containers.CVE-2022-0530/reproduce-fedora.sh:6-7CVE-2022-0530/reproduce-ubuntu.sh:6-7
The testcase file must be present in the same directory as the scripts.CVE-2022-0530/reproduce-fedora.sh:8-9CVE-2022-0530/reproduce-ubuntu.sh:8-9

Evidence-described exercise path

Build the Docker image using the provided Dockerfile (Fedora or Ubuntu).CVE-2022-0530/reproduce-fedora.sh:6-7CVE-2022-0530/reproduce-ubuntu.sh:6-7
Run the container with the testcase mounted read-only and execute unzip under valgrind to observe the crash.CVE-2022-0530/reproduce-fedora.sh:8-10CVE-2022-0530/reproduce-ubuntu.sh:8-10
Optionally drop into a shell inside the container for further investigation, with the testcase still available.CVE-2022-0530/reproduce-fedora.sh:12-14CVE-2022-0530/reproduce-ubuntu.sh:12-14

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The Dockerfiles only install debugging tools and unzip. The scripts mount a local testcase read-only and run unzip under valgrind, then optionally provide an interactive shell. No network connections, host file writes, privilege escalation, or persistence mechanisms are observed. All behavior targets the lab's own unzip target.

CVE-2022-0530/Dockerfile-fedora:1-4CVE-2022-0530/Dockerfile-ubuntu:1-11CVE-2022-0530/reproduce-fedora.sh:1-14CVE-2022-0530/reproduce-ubuntu.sh:1-14

Review boundaries

What the analysis did not establish

The testcase file is binary and uninspected; its exact structure is unknown.
No Compose file is present; the two Dockerfiles are independent and not orchestrated together.
The CVE association relies solely on the unit path identifier; no external CVE record is included in the evidence.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalinamailing list

http://seclists.org/fulldisclosure/2022/May/33

20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6mailing list

http://seclists.org/fulldisclosure/2022/May/35

20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4mailing list

http://seclists.org/fulldisclosure/2022/May/38

bugzilla.redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2051395

github.com

https://github.com/ByteHackr/unzip_poc

[debian-lts-announce] 20220922 [SECURITY] [DLA 3118-1] unzip security updatemailing list

https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-0530

security.gentoo.org

https://security.gentoo.org/glsa/202310-17

support.apple.comConfirmation

https://support.apple.com/kb/HT213255

support.apple.comConfirmation

https://support.apple.com/kb/HT213256

support.apple.comConfirmation

https://support.apple.com/kb/HT213257

DSA-5202Vendor advisory

https://www.debian.org/security/2022/dsa-5202