CVE-2008-0888 is a critical vulnerability affecting the unzip utility, specifically within the inflate_dynamic function's NEEDBITS macro, impacting products from Apple, Canonical, Debian, and the unzip_project. This flaw allows remote attackers to trigger a denial of service (crash) and potentially execute arbitrary code by manipulating invalid buffers, leading to a free of uninitialized or previously-freed data. With a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C), it presents a high-severity risk due to its network-based attack vector, medium complexity, and complete impact on confidentiality, integrity, and availability. Despite its age and high severity, there is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.06CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | ||
6.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* | ||
7.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* | ||
7.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* | ||
< 10.6.3CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2008-0888
Jun 11, 2024CVE-2008-0888
Dec 14, 2021unzip: free() called for uninitialized or already freed pointer
Mar 17, 2008The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.
Mar 2, 2008