CVE-2014-8140

Опубликовано: 31 янв. 2020

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

Ссылки

http://www.ocert.org/advisories/ocert-2014-011.html
Third Party Advisory
http://www.securitytracker.com/id/1031433
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2015:0700
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1174851
Issue Tracking
Third Party Advisory
http://www.ocert.org/advisories/ocert-2014-011.html
Third Party Advisory
http://www.securitytracker.com/id/1031433
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2015:0700
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1174851
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:unzip_project:unzip:*:*:*:*:*:*:*:*

Версия до 6.0 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.09912

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2014-8140

CVSS3: 7.8

ubuntu

больше 5 лет назад

CVE-2014-8140

redhat

больше 10 лет назад

CVE-2014-8140

CVSS3: 7.8

msrc

почти 5 лет назад

Описание отсутствует

CVE-2014-8140

CVSS3: 7.8

debian

больше 5 лет назад

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP U ...

GHSA-fhf3-rjhh-4c23

CVSS3: 7.8

github

около 3 лет назад

EPSS

Процентиль: 93%

0.09912

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787