Vulnerability Details : CVE-2014-9913

Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.

Vulnerability category: OverflowDenial of service

Published 2017-01-18 17:59:00

Updated 2019-12-16 20:24:15

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2014-9913

Probability of exploitation activity in the next 30 days: 0.84%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 80 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2014-9913

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	nvd@nist.gov
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
4.0	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	2.5	1.4	nvd@nist.gov
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2014-9913

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-9913

http://www.securityfocus.com/bid/95081

Info-ZIP UnZip CVE-2014-9913 Buffer Overflow Vulnerability
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2016/12/05/19

oss-security - CVE Request: Info-Zip zipinfo buffer overflow
Mailing List;Third Party Advisory

CVEs referencing this url
https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750

Bug #1643750 “Buffer Overflow in ZipInfo” : Bugs : unzip package : Ubuntu
Issue Tracking;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/12/05/13

oss-security - CVE Request: Info-Zip zipinfo buffer overflow
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2014/11/03/5

oss-security - unzip -l crasher
Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/12/05/20

oss-security - Re: CVE Request: Info-Zip zipinfo buffer overflow
Mailing List;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2014-9913

Unzip Project » Unzip » Version: 6.0
cpe:2.3:a:unzip_project:unzip:6.0:*:*:*:*:*:*:*
Matching versions