Rapid7 Vulnerability & Exploit Database

RHSA-2015:0700: unzip security update

Back to Search

RHSA-2015:0700: unzip security update

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Published
02/06/2015
Created
07/25/2018
Added
03/19/2015
Modified
07/04/2017

Description

The unzip utility is used to list, test, or extract files from azip archive.A buffer overflow was found in the way unzip uncompressed certain extrafields of a file. A specially crafted Zip archive could cause unzip tocrash or, possibly, execute arbitrary code when the archive was tested withunzip's '-t' option. (CVE-2014-9636)A buffer overflow flaw was found in the way unzip computed the CRC32checksum of certain extra fields of a file. A specially crafted Zip archivecould cause unzip to crash when the archive was tested with unzip's '-t'option. (CVE-2014-8139)An integer underflow flaw, leading to a buffer overflow, was found in theway unzip uncompressed certain extra fields of a file. A specially craftedZip archive could cause unzip to crash when the archive was tested withunzip's '-t' option. (CVE-2014-8140)A buffer overflow flaw was found in the way unzip handled Zip64 files.A specially crafted Zip archive could possibly cause unzip to crash whenthe archive was uncompressed. (CVE-2014-8141)Red Hat would like to thank oCERT for reporting the CVE-2014-8139,CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges MicheleSpagnuolo of the Google Security Team as the original reporter ofthese issues.All unzip users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues.

Solution(s)

  • redhat-upgrade-unzip
  • redhat-upgrade-unzip-debuginfo

References

  • redhat-upgrade-unzip
  • redhat-upgrade-unzip-debuginfo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;