Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2008-0888

Published: 17/03/2008 Updated: 15/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 828
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Info-zip

Vulnerability Summary

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

Vulnerable Product Search on Vulmon Subscribe to Product

info-zip unzip

Vendor Advisories

Ubuntu Security Notice: unzip vulnerability
Tavis Ormandy discovered that unzip did not correctly clean up pointers If a user or automated service was tricked into processing a specially crafted ZIP archive, a remote attacker could execute arbitrary code with user privileges ...
Debian Security Advisories: DSA-1522-1 unzip -- programming error
Tavis Ormandy discovered that unzip, when processing specially crafted ZIP archives, could pass invalid pointers to the C library's free routine, potentially leading to arbitrary code execution (CVE-2008-0888) For the old stable distribution (sarge), this problem has been fixed in version 552-1sarge5 For the stable distribution (etch), this prob ...

References

CWE-119https://issues.rpath.com/browse/RPL-2317http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:068http://www.redhat.com/support/errata/RHSA-2008-0196.htmlhttp://secunia.com/advisories/29427http://secunia.com/advisories/29440http://secunia.com/advisories/29415http://wiki.rpath.com/Advisories:rPSA-2008-0116http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0116http://www.debian.org/security/2008/dsa-1522http://www.ubuntu.com/usn/usn-589-1http://www.securityfocus.com/bid/28288http://www.securitytracker.com/id?1019634http://secunia.com/advisories/29432http://secunia.com/advisories/29406http://secunia.com/advisories/29495http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.htmlhttp://secunia.com/advisories/29392http://security.gentoo.org/glsa/glsa-200804-06.xmlhttp://secunia.com/advisories/29681http://www.vmware.com/security/advisories/VMSA-2008-0009.htmlhttp://secunia.com/advisories/30535http://www.ipcop.org/index.php?name=News&file=article&sid=40http://secunia.com/advisories/31204http://support.apple.com/kb/HT4077http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://www.vupen.com/english/advisories/2008/0913/referenceshttp://www.vupen.com/english/advisories/2008/1744https://exchange.xforce.ibmcloud.com/vulnerabilities/41246https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9733http://www.securityfocus.com/archive/1/493080/100/0/threadedhttp://www.securityfocus.com/archive/1/489967/100/0/threadedhttps://usn.ubuntu.com/589-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook