CVE-2014-9636

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20141222 Re: CVE Request: Info-ZIP unzip 6.0", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q4/1131"}, {"name": "62738", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62738"}, {"name": "GLSA-201611-01", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201611-01"}, {"name": "FEDORA-2015-1267", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html"}, {"name": "62751", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62751"}, {"name": "[oss-security] 20141222 CVE Request: Info-ZIP unzip 6.0", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2015/q1/216"}, {"name": "71825", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71825"}, {"name": "USN-2489-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2489-1"}, {"name": "DSA-3152", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3152"}, {"name": "[oss-security] 20141102 unzip -t crasher", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q4/489"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "FEDORA-2015-1189", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html"}, {"name": "[oss-security] 20141103 Re: unzip -t crasher", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q4/496"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-9636", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20141222 Re: CVE Request: Info-ZIP unzip 6.0", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q4/1131"}, {"name": "62738", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62738"}, {"name": "GLSA-201611-01", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201611-01"}, {"name": "FEDORA-2015-1267", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html"}, {"name": "62751", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62751"}, {"name": "[oss-security] 20141222 CVE Request: Info-ZIP unzip 6.0", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2015/q1/216"}, {"name": "71825", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71825"}, {"name": "USN-2489-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2489-1"}, {"name": "DSA-3152", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3152"}, {"name": "[oss-security] 20141102 unzip -t crasher", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q4/489"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "FEDORA-2015-1189", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html"}, {"name": "[oss-security] 20141103 Re: unzip -t crasher", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q4/496"}, {"name": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450", "refsource": "CONFIRM", "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:47:41.812Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20141222 Re: CVE Request: Info-ZIP unzip 6.0", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q4/1131"}, {"name": "62738", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62738"}, {"name": "GLSA-201611-01", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201611-01"}, {"name": "FEDORA-2015-1267", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html"}, {"name": "62751", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62751"}, {"name": "[oss-security] 20141222 CVE Request: Info-ZIP unzip 6.0", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2015/q1/216"}, {"name": "71825", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71825"}, {"name": "USN-2489-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2489-1"}, {"name": "DSA-3152", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3152"}, {"name": "[oss-security] 20141102 unzip -t crasher", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q4/489"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "FEDORA-2015-1189", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html"}, {"name": "[oss-security] 20141103 Re: unzip -t crasher", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q4/496"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-9636", "datePublished": "2015-02-06T15:00:00.000Z", "dateReserved": "2015-01-22T00:00:00.000Z", "dateUpdated": "2024-08-06T13:47:41.812Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unzip_project:unzip:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "4C9BC86B-F353-4390-B288-B528BA8AA0A1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*", "matchCriteriaId": "5D37DF0F-F863-45AC-853A-3E04F9FEC7CA", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*", "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*", "matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression."}, {"lang": "es", "value": "unzip 6.0 permite a atacantes remotos causar una denegaci\u00f3n de servicio (lectura o escritura fuera de rango y ca\u00edda) a trav\u00e9s de un campo extra con un tama\u00f1o comprimido m\u00e1s peque\u00f1o que el tama\u00f1o del campo comprimido en un archivo zip que anuncia la compresi\u00f3n del m\u00e9todo almacenado (STORED)."}], "id": "CVE-2014-9636", "lastModified": "2026-06-17T00:18:41.323", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-02-06T15:59:06.757", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/oss-sec/2014/q4/1131"}, {"source": "cve@mitre.org", "url": "http://seclists.org/oss-sec/2014/q4/489"}, {"source": "cve@mitre.org", "url": "http://seclists.org/oss-sec/2014/q4/496"}, {"source": "cve@mitre.org", "url": "http://seclists.org/oss-sec/2015/q1/216"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/62738"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/62751"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3152"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450"}, {"source": "cve@mitre.org", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/71825"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2489-1"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201611-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/oss-sec/2014/q4/1131"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/oss-sec/2014/q4/489"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/oss-sec/2014/q4/496"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/oss-sec/2015/q1/216"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/62738"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/62751"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3152"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2489-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201611-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2015:0700", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "unzip-0:6.0-2.el6_6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-03-18T00:00:00Z"}, {"advisory": "RHSA-2015:0700", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "unzip-0:6.0-15.ael7b", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-03-18T00:00:00Z"}], "bugzilla": {"description": "unzip: out-of-bounds read/write in test_compr_eb() in extract.c", "id": "1184985", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1184985"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "verified"}, "cwe": "CWE-20->CWE-122", "details": ["unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.", "A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option."], "name": "CVE-2014-9636", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "unzip", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2014-11-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-9636\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-9636"], "statement": "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/", "threat_severity": "Moderate"}

{}