Summary
Michele Spagnuolo of the Google
Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139), the test_compr_eb() function (CVE-2014-8140) and the getZip64Data() function (CVE-2014-8141), which may lead to the execution of arbitrary code.
Solution
For the stable distribution (wheezy),
these problems have been fixed in version 6.0-8+deb7u1.
For the upcoming stable distribution (jessie), these problems will be fixed soon.
For the unstable distribution (sid), these problems have been fixed in version 6.0-13.
We recommend that you upgrade your unzip packages.
Insight
InfoZIP's unzip program. With the
exception of multi-volume archives (ie, .ZIP files that are split across several disks using PKZIP's /& option), this can handle any file produced either by PKZIP, or the corresponding InfoZIP zip program.
Affected
unzip on Debian Linux
Detection
This check tests the installed software
version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-8139, CVE-2014-8140, CVE-2014-8141 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities