CVE-2014-8139

HIGH7.8EPSS 9.8%

unzip - security update

發布日:2020/1/31修改日:2025/12/3

也稱為:DSA-3113-1ALPINE-CVE-2014-8139DEBIAN-CVE-2014-8139

描述

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

受影響套件(5)

Alpine/unzipfrom 0, < 6.0-r3
Debian/unzipfrom 0, < 6.0-16
Debian/unzipfrom 0, < 6.0-4+deb6u1
Debian/unzipfrom 0, < 6.0-4+deb6u2
Debian/unzipfrom 0, < 6.0-8+deb7u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2014-8139
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-8139