CVE-2008-0888: apple mac_os_x

CVSS: 9.3v2.0HighAnalyzed

AliasesRHSA-2008:0196DEBIAN-CVE-2008-0888DSA-1522-1

Published 17-03-2008Last modified 26-08-2025

Vulnerability summary

CVE-2008-0888 is a high (CVSS 9.3) vulnerability in apple mac_os_x. EPSS estimates a 6.29% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

6.29%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

17-03-2008
PublishedVulnerability first disclosed.
26-08-2025
Last modifiedVulnerability information updated.

Description

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

6.29%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.29% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian2 products

unzip< 5.52-11 | < 5.52-1sarge5 | < 5.52-9etch1
debian_linuxEOL4.0

Redhat2 products

unzip< 0:5.50-31.EL2.1 | < 0:5.50-36.EL3
unzip-debuginfo< 0:5.50-36.EL3

Apple1 product

mac_os_x< 10.6.3

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04 | 7.10

Info-zip1 product

unzip< 6.0

Unzip_project1 product

unzip< 6.0

6 vendors · 8 products

References

39 links

secunia.com/advisories/29415Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securityfocus.com/archive/1/489967/100/0/threadedMailing ListX Refsource BUGTRAQBroken Link
secunia.com/advisories/29427Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vupen.com/english/advisories/2008/1744VDB EntryX Refsource VUPENBroken LinkVendor Advisory
secunia.com/advisories/29440Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.debian.org/security/2008/dsa-1522Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/29432Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
issues.rpath.com/browse/RPL-2317X Refsource CONFIRMBroken Link
wiki.rpath.com/Advisories:rPSA-2008-0116X Refsource CONFIRMBroken Link
www.vmware.com/security/advisories/VMSA-2008-0009.htmlX Refsource CONFIRMThird Party Advisory

Show all 39 references

lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEThird Party Advisory
secunia.com/advisories/29392Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/29681Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.mandriva.com/en/security/advisories?name=MDVSA-2008:068Vendor AdvisoryX Refsource MANDRIVANot Applicable
lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.vupen.com/english/advisories/2008/0913/referencesVDB EntryX Refsource VUPENBroken LinkVendor Advisory
secunia.com/advisories/30535Third Party AdvisoryX Refsource SECUNIABroken LinkPatchVendor Advisory
www.ipcop.org/index.php?name=News&file=article&sid=40X Refsource CONFIRMBroken Link
support.apple.com/kb/HT4077X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/archive/1/493080/100/0/threadedMailing ListX Refsource BUGTRAQBroken Link
security.gentoo.org/glsa/glsa-200804-06.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9733VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/29406Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/29495Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/31204Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securitytracker.com/id?1019634VDB EntryX Refsource SECTRACKBroken Link
www.redhat.com/support/errata/RHSA-2008-0196.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/41246VDB EntryX Refsource XFThird Party Advisory
www.ubuntu.com/usn/usn-589-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/28288VDB EntryX Refsource BIDBroken Link
wiki.rpath.com/wiki/Advisories:rPSA-2008-0116X Refsource CONFIRMBroken Link
access.redhat.com/errata/RHSA-2008:0196Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=431438REPORT
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0196.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-0888REPORT
www.cve.org/CVERecord?id=CVE-2008-0888Advisory
nvd.nist.gov/vuln/detail/CVE-2008-0888AdvisoryOval
security-tracker.debian.org/tracker/CVE-2008-0888Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities