PT-2014-8431 · Info Zip+5 · Unzip+5
Publicado
2014-12-28
·
Atualizado
2025-06-12
·
CVE-2014-8141
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Info-ZIP UnZip versions 6.0 and earlier
Description
The issue is related to a heap-based buffer overflow in the getZip64Data function, allowing remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command. This can be exploited by providing a specially designed zip file to the unzip command.
Recommendations
For Info-ZIP UnZip versions 6.0 and earlier, consider updating to a version that fixes this issue, as using a crafted zip file with the -t command argument to the unzip command can lead to arbitrary code execution.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Unzip