diff --git a/external/subpack/utils/unzip/patches/005-CVE-2015-7696-heap-overflow.patch b/external/subpack/utils/unzip/patches/005-CVE-2015-7696-heap-overflow.patch
new file mode 100644
index 0000000..df758a1
--- /dev/null
+++ b/external/subpack/utils/unzip/patches/005-CVE-2015-7696-heap-overflow.patch
@@ -0,0 +1,21 @@
+--- a/crypt.c
++++ b/crypt.c
+@@ -465,7 +465,17 @@ int decrypt(__G__ passwrd)
+     GLOBAL(pInfo->encrypted) = FALSE;
+     defer_leftover_input(__G);
+     for (n = 0; n < RAND_HEAD_LEN; n++) {
+-        b = NEXTBYTE;
++        /* 2012-11-23 SMS.  (OUSPG report.)
++         * Quit early if compressed size < HEAD_LEN.  The resulting
++         * error message ("unable to get password") could be improved,
++         * but it's better than trying to read nonexistent data, and
++         * then continuing with a negative G.csize.  (See
++         * fileio.c:readbyte()).
++         */
++        if ((b = NEXTBYTE) == (ush)EOF)
++        {
++            return PK_ERR;
++        }
+         h[n] = (uch)b;
+         Trace((stdout, " (%02x)", h[n]));
+     }