Anfälligkeitssuche        Suche in 172616 CVE Beschreibungen
und 81291 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.871338
Kategorie:Red Hat Local Security Checks
Titel:RedHat Update for unzip RHSA-2015:0700-01
Zusammenfassung:The remote host is missing an update for the 'unzip'; package(s) announced via the referenced advisory.
Beschreibung:Summary:
The remote host is missing an update for the 'unzip'
package(s) announced via the referenced advisory.

Vulnerability Insight:
The unzip utility is used to list, test, or extract files from a
zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra
fields of a file. A specially crafted Zip archive could cause unzip to
crash or, possibly, execute arbitrary code when the archive was tested with
unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32
checksum of certain extra fields of a file. A specially crafted Zip archive
could cause unzip to crash when the archive was tested with unzip's '-t'
option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the
way unzip uncompressed certain extra fields of a file. A specially crafted
Zip archive could cause unzip to crash when the archive was tested with
unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when
the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139,
CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele
Spagnuolo of the Google Security Team as the original reporter of
these issues.

All unzip users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Affected Software/OS:
unzip on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Server (v. 7),
Red Hat Enterprise Linux Workstation (v. 6)

Solution:
Please Install the Updated Packages.

CVSS Score:
6.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2014-8139
http://www.ocert.org/advisories/ocert-2014-011.html
http://www.securitytracker.com/id/1031433
https://access.redhat.com/errata/RHSA-2015:0700
https://bugzilla.redhat.com/show_bug.cgi?id=1174844
Common Vulnerability Exposure (CVE) ID: CVE-2014-8140
https://bugzilla.redhat.com/show_bug.cgi?id=1174851
Common Vulnerability Exposure (CVE) ID: CVE-2014-8141
https://bugzilla.redhat.com/show_bug.cgi?id=1174856
Common Vulnerability Exposure (CVE) ID: CVE-2014-9636
BugTraq ID: 71825
http://www.securityfocus.com/bid/71825
Debian Security Information: DSA-3152 (Google Search)
http://www.debian.org/security/2015/dsa-3152
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html
https://security.gentoo.org/glsa/201611-01
http://seclists.org/oss-sec/2014/q4/489
http://seclists.org/oss-sec/2014/q4/496
http://seclists.org/oss-sec/2015/q1/216
http://seclists.org/oss-sec/2014/q4/1131
http://secunia.com/advisories/62738
http://secunia.com/advisories/62751
http://www.ubuntu.com/usn/USN-2489-1
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

Dies ist nur einer von 81291 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2020 E-Soft Inc. Alle Rechte vorbehalten.