CVE-2014-8139

HIGH7.8EPSS 9.8%

unzip - security update

Published: 1/31/2020Modified: 4/28/2026

Description

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Affected packages (5)

Alpine/unzipfrom 0, < 6.0-r3
Debian/unzipfrom 0, < 6.0-16
Debian/unzipfrom 0, < 6.0-4+deb6u1
Debian/unzipfrom 0, < 6.0-4+deb6u2
Debian/unzipfrom 0, < 6.0-8+deb7u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2014-8139
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-8139