Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Unzip 6.0 and earlier may execute harmful code

published 6 years ago
Summary

The unzip program version 6.0 and earlier can be tricked by a specially crafted zip file when the test command is used, allowing an attacker to run code on your system. This could let an outsider take control or steal data. Upgrade to a newer unzip version or apply the vendor’s patch to eliminate the risk.

What to do
  • Update azure unzip to version 6.0-20.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure unzip < 6.0-20
Fix: upgrade to 6.0-20
Original advisory text
CVE-2014-8140 affecting package unzip for versions less than 6.0-20
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Timeline
Published31 Jan 2020
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-35332 · OSV
Track software like this
Free during beta