CVE-2014-8140

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Updated unzip package fix security vulnerabilities:

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues.

These are all security issues fixed in the unzip-6.00-31.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following security issues:

* CVE-2014-8139: input sanitization errors (bnc#909214)
* CVE-2014-9636: out-of-bounds read/write in test_compr_eb()
  (bnc#914442)

Security Issues:

* CVE-2014-9636
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9636>
* CVE-2014-8139
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139>

Wolfgang Ettlinger discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.