CVE-2008-0888

Published: 17 March 2008

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

Priority

Status

Package	Release	Status
unzip Launchpad, Ubuntu, Debian	dapper	Released (5.52-6ubuntu4.1)
	edgy	Released (5.52-8ubuntu1.1)
	feisty	Released (5.52-9ubuntu3.1)
	gutsy	Released (5.52-10ubuntu1.1)
	upstream	Needed

References

https://ubuntu.com/security/notices/USN-589-1
https://www.cve.org/CVERecord?id=CVE-2008-0888
NVD
Launchpad
Debian

Bugs

https://launchpad.net/bugs/203461

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›