The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

🗓️ 25 Sep 2020 00:00:00Reported by MicrosoftType

The NEEDBITS macro in inflate_dynamic with invalid buffers in unzip's inflate.c can cause denial of service and code execution.

Reporter	Title	Published	Views	Family All 64
AlpineLinux	CVE-2008-0888	17 Mar 200821:00	–	alpinelinux
CBLMariner	CVE-2008-0888 affecting package unzip 6.0-19	8 Oct 202018:09	–	cbl_mariner
CBLMariner	CVE-2008-0888 affecting package unzip for versions less than 6.0-20	19 Mar 202417:21	–	cbl_mariner
CBLMariner	CVE-2008-0888 affecting package unzip for versions less than 6.0-19	9 Apr 202206:51	–	cbl_mariner
Tenable Nessus	CentOS 3 : unzip (CESA-2008:0196)	19 Mar 200800:00	–	nessus
Tenable Nessus	Debian DSA-1522-1 : unzip - programming error	21 Mar 200800:00	–	nessus
Tenable Nessus	GLSA-200804-06 : UnZip: User-assisted execution of arbitrary code	11 Apr 200800:00	–	nessus
Tenable Nessus	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	29 Mar 201000:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : unzip (MDVSA-2008:068)	23 Apr 200900:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: unzip (CVE-2008-0888)	2 Jul 202400:00	–	nessus