Software Engineering Institute

WinZip Computing, Inc.'s WinZip is a popular utility for creating and extracting a variety of archive file formats on Microsoft Windows-based systems. A buffer overflow error exists in the way that WinZip handles certain parameters of MIME archives.

This error results in a vulnerability when WinZip attempts to interpret invalid data in a MIME-encoded file.

An attacker could exploit this vulnerability by introducing a specially-crafted file to be opened by WinZip, and then coaxing or tricking a user or application into opening it. The malicious file could be introduced in a number of ways including, but not limited to, a remote web page, an email attachment, peer-to-peer file sharing, or network filesystems.

An attacker could execute arbitrary code of their choice on a vulnerable system.

Upgrade to the latest version of the software

WinZip Computing, Inc. has released an updated version of the WinZip software that includes a fix for this vulnerability. Users are strongly encouraged to upgrade to this version of the software. More details can be found in the Systems Affected section of this document.