CVE-2008-0888

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-17 · updated 2026-06-16
Weakness: CWE-119

Description

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

Affected products

macOS: before 10.6.3 — fixed in 10.6.3
Canonical Ubuntu Linux: 6.06, 6.10, 7.04, 7.10
Debian Linux: 4.0
github.com/yi-ge/unzip: before 6.0 — fixed in 6.0

How to fix

Upgrade to a fixed version: macOS 10.6.3; github.com/yi-ge/unzip 6.0. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html
http://secunia.com/advisories/29392
http://secunia.com/advisories/29406
http://secunia.com/advisories/29415
http://secunia.com/advisories/29427
http://secunia.com/advisories/29432
http://secunia.com/advisories/29440
http://secunia.com/advisories/29495
http://secunia.com/advisories/29681
http://secunia.com/advisories/30535
http://secunia.com/advisories/31204

Get alerted when CVE-2008-0888 or the next vulnerability affects your stack