- Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - CVE-2014-9636 unzip: out-of-bounds read/write in     test_compr_eb() in extract.c - re-fix (see     https://bugzilla.redhat.com/show_bug.cgi?id=1184985#c7)

    - Fix CVE-2014-8139 - CRC32 verification heap-based       buffer overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - input sanitization errors. (bnc#909214). (CVE-2014-8139)

  - out-of-bounds read/write in test_compr_eb()     (bnc#914442). (CVE-2014-9636)

An update of the unzip package has been released.

Updated unzip packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The unzip utility is used to list, test, or extract files from a zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter of these issues.

All unzip users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.

The remote host is affected by the vulnerability described in GLSA-201611-01 (UnZip: Multiple vulnerabilities)

    Multiple vulnerabilities were found in UnZip. Please review the       referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could execute arbitrary code or cause Denial of       Service.
  Workaround :

    There is no known workaround at this time.

unzip was updated to fix security issues.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() functions (CVE-2014-8141). The input errors may result in in arbitrary code execution.

More info can be found in the oCert announcement:
http://seclists.org/oss-sec/2014/q4/1127

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140     (CVE-2014-8141) Resolves: #1196132 #1196120 #1196124     #1196128

The CentOS Linux 7.9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1650 advisory.

    This advisory aggregates security fixes for the unzip SRPM in CIQ CentOS Bridge 7.9. It addresses 9 CVEs:
    CVE-2019-13232, CVE-2018-1000035, CVE-2005-4667, CVE-2008-0888, CVE-2014-8139, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
81454	Fedora 20 : unzip-6.0-17.fc20 (2015-1993)	Nessus	Fedora Local Security Checks	2015/2/24	2021/1/11	medium
81543	SuSE 11.3 Security Update : unzip (SAT Patch Number 10344)	Nessus	SuSE Local Security Checks	2015/2/26	2021/1/6	medium
204444	Photon OS 4.0: Unzip PHSA-2023-4.0-0397	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/10/16	high
134212	Photon OS 3.0: Unzip PHSA-2020-3.0-0063	Nessus	PhotonOS Local Security Checks	2020/3/2	2025/8/22	high
81949	RHEL 6 / 7 : unzip (RHSA-2015:0700)	Nessus	Red Hat Local Security Checks	2015/3/19	2020/2/6	high
82263	Scientific Linux Security Update : unzip on SL6.x, SL7.x i386/x86_64 (20150318)	Nessus	Scientific Linux Local Security Checks	2015/3/26	2021/1/14	high
85950	F5 Networks BIG-IP : Multiple unzip vulnerabilities (SOL16480)	Nessus	F5 Networks Local Security Checks	2015/9/16	2021/3/10	high
94460	GLSA-201611-01 : UnZip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/11/2	2026/1/20	high
203629	Photon OS 5.0: Unzip PHSA-2023-5.0-0057	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/10/14	high
134423	Photon OS 2.0: Unzip PHSA-2020-2.0-0213	Nessus	PhotonOS Local Security Checks	2020/3/11	2024/7/23	high
332628	Photon OS 5.0: Unzip PHSA-2023-5.0-91-0057	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	high
81252	openSUSE Security Update : unzip (openSUSE-2015-119)	Nessus	SuSE Local Security Checks	2015/2/10	2021/1/19	high
81968	OracleVM 3.3 : unzip (OVMSA-2015-0037)	Nessus	OracleVM Local Security Checks	2015/3/20	2021/1/4	high
369924	CentOS Linux 7.9 [CIQ] Security Update: unzip Multiple Vulnerabilities (ciqsa-2026_1650)	Nessus	CentOS Local Security Checks	2026/10/21	2026/10/21	high

检测

插件搜索

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high