CVE-2014-8140

HIGH

unzip < 6.0 - Remote Code Execution via Crafted Zip File in -t Command Argument

Title source: llm

Description

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References (4)

Core 4

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1174851

Third Party Advisory, VDB Entry x_refsource_misc

http://www.securitytracker.com/id/1031433

Third Party Advisory x_refsource_misc

http://www.ocert.org/advisories/ocert-2014-011.html

Third Party Advisory x_refsource_misc

https://access.redhat.com/errata/RHSA-2015:0700

Scores

CVSS v3 7.8

EPSS 0.0745

EPSS Percentile 93.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (24)

redhat/enterprise_linux_desktop 6.0

redhat/enterprise_linux_desktop 7.0

redhat/enterprise_linux_server 6.0

redhat/enterprise_linux_server 7.0

redhat/enterprise_linux_server_aus 6.6

redhat/enterprise_linux_server_aus 7.3

redhat/enterprise_linux_server_aus 7.4

redhat/enterprise_linux_server_aus 7.6

redhat/enterprise_linux_server_aus 7.7

redhat/enterprise_linux_server_eus 6.6

... and 14 more

Published Jan 31, 2020

Tracked Since Feb 18, 2026