Heap Overflow in unzip Package
Summary
DSA-3152-1: unzip - security update. Affects unzip versions < 6.0-8+deb7u2. Fixed in 6.0-8+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The unzip package is a utility used for extracting files from ZIP archives. It is commonly used to decompress files and folders in various operating systems. The package provides functionality to handle different compression methods and supports a wide range of archive formats. However, a vulnerability has been discovered in the test_compr_eb() function of the unzip package, which can lead to a heap overflow.
Vulnerability Detail
The vulnerability in the unzip package arises from a flaw in the test_compr_eb() function. An attacker can exploit this flaw by crafting a malicious ZIP archive that triggers an out-of-bounds read and write access to memory locations. By carefully manipulating the archive, the attacker can cause a heap overflow, potentially resulting in a crash of the application or other unspecified impacts. This vulnerability has been assigned the identifier CVE-2014-8139.
How To Fix
Minimum fixed version
6.0-8+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to apply the recommended fix by upgrading the unzip package to the patched versions.
Conclusion
The unzip package is vulnerable to a heap overflow due to a flaw in the test_compr_eb() function. To mitigate this vulnerability, it is crucial to upgrade the package to the recommended patched versions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unzip →
FAQ
The vulnerability can lead to a heap overflow, potentially causing the application to crash or resulting in other unspecified impacts.
An attacker can exploit this vulnerability by crafting a corrupt ZIP archive that triggers the out-of-bounds read and write access to memory locations.
The vulnerability affects the unzip package in the stable distribution (wheezy) up to version 6.0-8+deb7u1 and the unstable distribution (sid) up to version 6.0-15.
Yes, this vulnerability has been assigned the identifier CVE-2014-8139.
There are no known exploits for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for unzip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
