Critical Buffer Overflow Vulnerability in UnZip Package
Summary
ALPINE-CVE-2014-8139: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command. Affects unzip versions < 6.0-r3. Fixed in 6.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The UnZip package is a widely used utility for extracting files from ZIP archives. It is part of the Info-ZIP project and is known for its efficiency and compatibility with various ZIP formats. However, certain versions of UnZip are vulnerable to a heap-based buffer overflow, which can be exploited by attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2014-8139, arises from a heap-based buffer overflow in the CRC32 verification process of UnZip 6.0 and earlier versions. Attackers can exploit this vulnerability by crafting a malicious ZIP file and using the -t command argument with the unzip command. If successful, this could lead to remote code execution, allowing attackers to gain unauthorized access and control over the affected system.
How To Fix
Minimum fixed version
6.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade unzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the -t command with potentially untrusted ZIP files until the package is updated. This reduces the risk of exploitation through this specific command.
Conclusion
The UnZip package has a critical vulnerability that can lead to remote code execution if not addressed. Users are strongly advised to update to the patched version to mitigate risks. Temporary workarounds can be employed until the update is completed.
See every vulnerability recorded for unzip →
FAQ
CVE-2014-8139 is a vulnerability in the UnZip package that allows remote attackers to execute arbitrary code via a crafted ZIP file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.8, indicating a high level of severity.
If an immediate update is not possible, refrain from using the -t command with untrusted ZIP files as a temporary measure.
For more information on open-source vulnerabilities, you can visit Vulert, which monitors and alerts for vulnerabilities using a manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for unzip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
