CVE-2014-8141

HIGH

Info-ZIP UnZip < 6.0 - Heap-based Buffer Overflow via Crafted Zip File

Title source: llm

Description

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

References (4)

Core 4

Core References

Third Party Advisory x_refsource_misc

http://www.ocert.org/advisories/ocert-2014-011.html

Third Party Advisory x_refsource_misc

https://access.redhat.com/errata/RHSA-2015:0700

Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1174856

Third Party Advisory, VDB Entry x_refsource_misc

http://www.securitytracker.com/id/1031433

Scores

CVSS v3 7.8

EPSS 0.0745

EPSS Percentile 93.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (18)

redhat/enterprise_linux_desktop 6.0

redhat/enterprise_linux_desktop 7.0

redhat/enterprise_linux_server 6.0

redhat/enterprise_linux_server 7.0

redhat/enterprise_linux_server_eus 6.6

redhat/enterprise_linux_server_eus 7.1

redhat/enterprise_linux_server_eus 7.2

redhat/enterprise_linux_server_eus 7.3

redhat/enterprise_linux_server_eus 7.4

redhat/enterprise_linux_server_eus 7.5

... and 8 more

Published Jan 31, 2020

Tracked Since Feb 18, 2026