Out-of-bounds read in UnZip - CVE-2014-9636
Published: July 7, 2018 / Updated: July 9, 2018
Vulnerability identifier: #VU13613
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-9636
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to out-of-bounds read when handling malicious input. A remote attacker can supply extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression and cause the service to crash.
Affected software
UnZip
Amazon Linux AMI
Gentoo Linux
Opensuse
Fedora
unzip (Alpine package)
unzip
Amazon Linux AMI
Gentoo Linux
Opensuse
Fedora
unzip (Alpine package)
unzip
How to mitigate CVE-2014-9636
Install update from vendor's website.
unzip (Alpine package) - update to 6.0-r3
unzip - addressed in versions 6.0-18.fc21, 6.0-20.fc21
unzip - addressed in versions 6.0-18.fc21, 6.0-20.fc21