{"id":"CVE-2014-8140","aliases":["ALPINE-CVE-2014-8140","AZL-35332","AZL-6934","BELL-CVE-2014-8140","DEBIAN-CVE-2014-8140","DLA-124-1","DSA-3113-1","EUVD-2014-7983","GHSA-fhf3-rjhh-4c23","MGASA-2014-0562","RHSA-2015:0700","SUSE-SU-2015:0377-1","UBUNTU-CVE-2014-8140","USN-2472-1","openSUSE-SU-2024:10480-1"],"status":"published","title":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows...","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07448,"percentile":0.94491,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2014-12-28T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-19"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unzip","fixed_in":["6.0-13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unzip","fixed_in":["6.0-13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unzip","fixed_in":["6.0-13"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-13"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-13"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-4+deb6u1"}]}],"versions":["6.0-4"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-8+deb7u1"}]}],"versions":["6.0-8"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-7.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.ael7b"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.ael7b"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.1"}]}],"versions":["6.0-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.1"}]}],"versions":["6.0-9ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-31.1"}]}],"bundled":5}],"products":[{"vendor":"info-zip","product":"unzip"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"http://www.ocert.org/advisories/ocert-2014-011.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0700","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174851","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1031433","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8140","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8140","tags":["report"]},{"url":"https://github.com/advisories/GHSA-fhf3-rjhh-4c23"},{"url":"https://security.alpinelinux.org/vuln/CVE-2014-8140","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-8140","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8140","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0562.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174856","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/12/22/12","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184985","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0700.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8139","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8140","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8141","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9636","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150377-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/909214","tags":["report"]},{"url":"https://bugzilla.suse.com/914442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9636","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-8140","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2472-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-8139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8141","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7697","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:00:32Z","modified":"2024-08-06T13:10:50.891Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-7983","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:00:32Z","modified":"2024-08-06T13:10:50Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-fhf3-rjhh-4c23","title":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows...","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2022-05-17T19:57:23Z","modified":"2023-02-10T05:07:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:03.896291Z"}],"nvd":[{"id":"CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10.903Z","modified":"2026-06-17T00:16:21.75Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"ALPINE-CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10.903Z","modified":"2026-10-23T15:17:40.504243579Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"AZL-35332","title":"CVE-2014-8140 affecting package unzip for versions less than 6.0-20","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6934","title":"CVE-2014-8140 affecting package unzip for versions less than 6.0-19","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10Z","modified":"2026-04-21T04:38:34.777887Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"BELL-CVE-2014-8140","title":"CVE-2014-8140 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:23.410252Z","modified":"2026-01-26T09:50:01.472723Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10Z","modified":"2026-04-16T06:16:43.460443294Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2020-01-31T22:15:10.903Z","modified":"2026-10-23T16:00:58.56268094Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-8140","description":"Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.","status":"published","published":"2014-12-28T00:00:00Z","modified":"2026-02-04T02:40:33.159711Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-124-1","title":"unzip - security update","status":"published","published":"2014-12-28T00:00:00Z","modified":"2026-03-09T01:01:32.630296Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3113-1","title":"unzip - security update","status":"published","published":"2014-12-28T00:00:00Z","modified":"2026-03-09T01:21:58.27915Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0562","title":"Updated unzip package fixes security vulnerabilities","description":"Updated unzip package fix security vulnerabilities:\n\nThe unzip command line tool is affected by heap-based buffer overflows within\nthe CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140)\nand the getZip64Data() (CVE-2014-8141) functions. The input errors may result\nin arbitrary code execution. A specially crafted zip file, passed to the\ncommand unzip -t, can be used to trigger the vulnerability.\n\nOOB access (both read and write) issues also exist in test_compr_eb()\nthat can result in application crash or other unspecified impact. A\nspecially crafted zip file, passed to the command unzip -t, can be used to\ntrigger the issues.\n","status":"published","published":"2014-12-31T12:28:04Z","modified":"2026-04-16T06:26:00.363966632Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10480-1","title":"unzip-6.00-31.1 on GA media","description":"These are all security issues fixed in the unzip-6.00-31.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:33.807694Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2015:0700","title":"Red Hat Security Advisory: unzip security update","status":"published","published":"2024-09-15T22:21:46Z","modified":"2026-06-28T10:13:20Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0377-1","title":"Security update for unzip","description":"\nThis update fixes the following security issues:\n\n    * CVE-2014-8139: input sanitization errors (bnc#909214)\n    * CVE-2014-9636: out-of-bounds read/write in test_compr_eb()\n      (bnc#914442)\n\nSecurity Issues:\n\n    * CVE-2014-9636\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9636\u003e\n    * CVE-2014-8139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139\u003e\n\n","status":"published","published":"2015-02-20T20:23:48Z","modified":"2026-02-04T03:58:31.230221Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"USN-2472-1","title":"unzip vulnerabilities","description":"Wolfgang Ettlinger discovered that unzip incorrectly handled certain\nmalformed zip archives. If a user or automated system were tricked into\nprocessing a specially crafted zip archive, an attacker could possibly\nexecute arbitrary code.\n","status":"published","published":"2015-01-14T20:18:09Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}