{"id":"CVE-2014-9636","aliases":["ALPINE-CVE-2014-9636","AZL-35334","AZL-6936","BELL-CVE-2014-9636","DEBIAN-CVE-2014-9636","DLA-150-1","DSA-3152-1","EUVD-2014-9446","GHSA-9gph-v8wv-c92v","RHSA-2015:0700","SUSE-SU-2015:0355-1","SUSE-SU-2015:0377-1","SUSE-SU-2018:1883-1","SUSE-SU-2018:2978-1","UBUNTU-CVE-2014-9636","USN-2489-1","openSUSE-SU-2024:11485-1"],"status":"published","title":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and...","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.11874,"percentile":0.96123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-12-31T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"unzip","fixed_in":["6.0-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"unzip","fixed_in":["6.0-20"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"unzip","fixed_in":["6.0-19"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"unzip","fixed_in":["6.0-15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unzip","fixed_in":["6.0-15"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unzip","fixed_in":["6.0-15"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"unzip","fixed_in":["6.0-8+deb7u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"unzip","fixed_in":["6.00-32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"unzip","fixed_in":["6.00-32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"unzip","fixed_in":["6.00-32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"unzip","fixed_in":["6.0-9ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-r3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-20"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-19"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-15"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-15"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-15"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-4+deb6u2"}]}],"versions":["6.0-4"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-8+deb7u2"}]}],"versions":["6.0-8","6.0-8+deb7u1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.ael7b"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.ael7b"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0-15.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-33.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.2"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-9ubuntu1.2"}]}],"versions":["6.0-9ubuntu1","6.0-9ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"unzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.00-39.1"}]}],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"unzip_project","product":"unzip"}],"references":[{"url":"http://seclists.org/oss-sec/2014/q4/1131","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/62738","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201611-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/62751","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://seclists.org/oss-sec/2015/q1/216","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/71825","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2489-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3152","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://seclists.org/oss-sec/2014/q4/489","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://seclists.org/oss-sec/2014/q4/496","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.info-zip.org/phpBB3/viewtopic.php?f=7\u0026t=450","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9636","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9gph-v8wv-c92v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2014-9636","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-9636","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9636","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0700","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184985","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0700.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8139","tags":["advisory"]},{"url":"http://www.ocert.org/advisories/ocert-2014-011.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8140","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8140","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8140","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8141","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9636","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150355-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/914442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150377-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/909214","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8141","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1080074","tags":["report"]},{"url":"https://bugzilla.suse.com/910683","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182978-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013992","tags":["report"]},{"url":"https://bugzilla.suse.com/1013993","tags":["report"]},{"url":"https://bugzilla.suse.com/950110","tags":["report"]},{"url":"https://bugzilla.suse.com/950111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9844","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9636","tags":["report"]},{"url":"http://seclists.org/oss-sec/2014/q4/507","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2489-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18384","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:00:00Z","modified":"2024-08-06T13:47:41.812Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9446","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:00:00Z","modified":"2024-08-06T13:47:41Z","updated_at":"2026-11-03T01:56:48.455518Z"}],"ghsa":[{"id":"GHSA-9gph-v8wv-c92v","title":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and...","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2022-05-13T01:30:16Z","modified":"2023-02-01T05:07:59Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:39.462624Z"}],"nvd":[{"id":"CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06.757Z","modified":"2026-06-17T00:18:41.323Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"BELL-CVE-2014-9636","title":"CVE-2014-9636 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:07.500323Z","modified":"2026-01-28T07:21:33.54634Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"ALPINE-CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06.757Z","modified":"2026-10-23T15:17:40.509898762Z","updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"AZL-35334","title":"CVE-2014-9636 affecting package unzip for versions less than 6.0-20","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6936","title":"CVE-2014-9636 affecting package unzip for versions less than 6.0-19","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06Z","modified":"2026-04-21T04:38:34.933727Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06Z","modified":"2026-04-10T03:44:51.830438Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2015-02-06T15:59:06.757Z","modified":"2026-10-23T15:47:31.458641746Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-150-1","title":"unzip - security update","status":"published","published":"2015-02-07T00:00:00Z","modified":"2026-03-09T01:01:56.046638Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3152-1","title":"unzip - security update","status":"published","published":"2015-02-03T00:00:00Z","modified":"2026-03-09T01:22:58.544664Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"openSUSE-SU-2024:11485-1","title":"unzip-6.00-39.1 on GA media","description":"These are all security issues fixed in the unzip-6.00-39.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:40.428489Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"RHSA-2015:0700","title":"Red Hat Security Advisory: unzip security update","status":"published","published":"2024-09-15T22:21:46Z","modified":"2026-06-28T10:13:20Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0355-1","title":"Security update for unzip","description":"unzip was updated to fix one security issue.\n\nThis security issue was fixed:\n- Out-of-bounds read/write in test_compr_eb() in extract.c (CVE-2014-9636).\n  ","status":"published","published":"2015-01-30T13:46:36Z","modified":"2026-02-04T02:21:12.597706Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0377-1","title":"Security update for unzip","description":"\nThis update fixes the following security issues:\n\n    * CVE-2014-8139: input sanitization errors (bnc#909214)\n    * CVE-2014-9636: out-of-bounds read/write in test_compr_eb()\n      (bnc#914442)\n\nSecurity Issues:\n\n    * CVE-2014-9636\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9636\u003e\n    * CVE-2014-8139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139\u003e\n\n","status":"published","published":"2015-02-20T20:23:48Z","modified":"2026-02-04T03:58:31.230221Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2018:1883-1","title":"Security update for unzip","description":"This update for unzip fixes the following issues:\n\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074)\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n","status":"published","published":"2018-07-05T06:38:08Z","modified":"2026-02-04T02:16:23.583663Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2978-1","title":"Security update for unzip","description":"This update for unzip fixes the following security issues:\n\n- CVE-2014-9913: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013993)\n- CVE-2015-7696: Specially crafted zip files with password protection could\n  trigger a crash and lead to denial of service (bsc#950110)\n- CVE-2015-7697: Specially crafted zip files could trigger an endless loop and\n  lead to denial of service (bsc#950111)\n- CVE-2016-9844: Specially crafted zip files could trigger invalid memory\n  writes possibly resulting in DoS or corruption (bsc#1013992)\n- CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of\n  password-protected archives that allowed an attacker to perform a denial of\n  service or to possibly achieve code execution (bsc#1080074).\n- CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and\n  crash) via an extra field with an uncompressed size smaller than the compressed\n  field size in a zip archive that advertises STORED method compression\n  (bsc#914442).\n\nThis non-security issue was fixed:\n\n+- Allow processing of Windows zip64 archives (Windows archivers set\n  total_disks field to 0 but per standard, valid values are 1 and higher)\n  (bnc#910683)\n","status":"published","published":"2018-10-02T14:30:55Z","modified":"2026-02-04T03:44:07.531458Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"UBUNTU-CVE-2014-9636","description":"unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.","status":"published","published":"2014-12-31T00:00:00Z","modified":"2026-02-04T02:42:57.005118Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2489-1","title":"unzip vulnerability","description":"Michal Zalewski discovered that unzip incorrectly handled certain\nmalformed zip archives. If a user or automated system were tricked into\nprocessing a specially crafted zip archive, an attacker could possibly\nexecute arbitrary code.\n","status":"published","published":"2015-02-03T18:00:55Z","modified":"2026-02-10T04:40:52Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}