{"schemaVersion":3,"id":"CVE-2008-0888","aliases":["RHSA-2008:0196","DEBIAN-CVE-2008-0888","DSA-1522-1"],"status":"published","duplicateOf":null,"title":null,"description":"The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.","dates":{"published":"2008-03-17T21:00:00.000Z","modified":"2025-08-26T12:17:22.176Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0629,"percentile":0.93526,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0629},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0629,"percentile":0.93526}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0629,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0629,"percentile":0.93526}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"apple","product":"mac_os_x","name":"mac os x","label":"mac_os_x","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 10.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.6.3","eol":null,"hubHref":"/vendor/apple/mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.06","noFixRecorded":false,"fixedIn":null},{"text":"6.10","noFixRecorded":false,"fixedIn":null},{"text":"7.04","noFixRecorded":false,"fixedIn":null},{"text":"7.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.06 | 6.10 | 7.04 | 7.10","eol":{"isEol":true,"eolDate":"2011-06-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.06","label":"6.06 'Dapper Drake' (LTS)","eolFrom":"2011-06-01T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"6.06.2"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"unzip","name":"unzip","label":"unzip","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/unzip","purlType":"deb","versions":[{"text":"< 5.52-11","noFixRecorded":false,"fixedIn":null},{"text":"< 5.52-1sarge5","noFixRecorded":false,"fixedIn":null},{"text":"< 5.52-9etch1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.52-11 | < 5.52-1sarge5 | < 5.52-9etch1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":{"isEol":true,"eolDate":"2010-02-15T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4","label":"4 (Etch)","eolFrom":"2010-02-15T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.0r9"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"info-zip","product":"unzip","name":"unzip","label":"unzip","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0","eol":null,"hubHref":"/vendor/info-zip/unzip"},{"vendor":"redhat","product":"unzip","name":"unzip","label":"unzip","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/unzip","purlType":"rpm","versions":[{"text":"< 0:5.50-31.EL2.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0:5.50-36.EL3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:5.50-31.EL2.1 | < 0:5.50-36.EL3","eol":null,"hubHref":null},{"vendor":"redhat","product":"unzip-debuginfo","name":"unzip-debuginfo","label":"unzip-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/unzip-debuginfo","purlType":"rpm","versions":[{"text":"< 0:5.50-36.EL3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:5.50-36.EL3","eol":null,"hubHref":null},{"vendor":"unzip_project","product":"unzip","name":"unzip","label":"unzip","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0","eol":null,"hubHref":"/vendor/unzip_project/unzip"}],"affectedCount":8,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://secunia.com/advisories/29415","label":"secunia.com/advisories/29415","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/489967/100/0/threaded","label":"www.securityfocus.com/archive/1/489967/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link"]},{"url":"http://secunia.com/advisories/29427","label":"secunia.com/advisories/29427","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/1744","label":"www.vupen.com/english/advisories/2008/1744","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/29440","label":"secunia.com/advisories/29440","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1522","label":"www.debian.org/security/2008/dsa-1522","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/29432","label":"secunia.com/advisories/29432","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"https://issues.rpath.com/browse/RPL-2317","label":"issues.rpath.com/browse/RPL-2317","hostname":"issues.rpath.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0116","label":"wiki.rpath.com/Advisories:rPSA-2008-0116","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2008-0009.html","label":"www.vmware.com/security/advisories/VMSA-2008-0009.html","hostname":"www.vmware.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html","label":"lists.apple.com/archives/security-announce/2010//Mar/msg00001.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/29392","label":"secunia.com/advisories/29392","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/29681","label":"secunia.com/advisories/29681","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:068","label":"www.mandriva.com/en/security/advisories?name=MDVSA-2008:068","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Not Applicable"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html","label":"lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/0913/references","label":"www.vupen.com/english/advisories/2008/0913/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/30535","label":"secunia.com/advisories/30535","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.ipcop.org/index.php?name=News&file=article&sid=40","label":"www.ipcop.org/index.php?name=News&file=article&sid=40","hostname":"www.ipcop.org","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"http://support.apple.com/kb/HT4077","label":"support.apple.com/kb/HT4077","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/493080/100/0/threaded","label":"www.securityfocus.com/archive/1/493080/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link"]},{"url":"http://security.gentoo.org/glsa/glsa-200804-06.xml","label":"security.gentoo.org/glsa/glsa-200804-06.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9733","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9733","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://secunia.com/advisories/29406","label":"secunia.com/advisories/29406","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/29495","label":"secunia.com/advisories/29495","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://secunia.com/advisories/31204","label":"secunia.com/advisories/31204","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id?1019634","label":"www.securitytracker.com/id?1019634","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0196.html","label":"www.redhat.com/support/errata/RHSA-2008-0196.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41246","label":"exchange.xforce.ibmcloud.com/vulnerabilities/41246","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-589-1","label":"www.ubuntu.com/usn/usn-589-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/28288","label":"www.securityfocus.com/bid/28288","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0116","label":"wiki.rpath.com/wiki/Advisories:rPSA-2008-0116","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"https://access.redhat.com/errata/RHSA-2008:0196","label":"access.redhat.com/errata/RHSA-2008:0196","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#moderate","label":"www.redhat.com/security/updates/classification/","hostname":"www.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=431438","label":"bugzilla.redhat.com/show_bug.cgi?id=431438","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0196.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0196.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-0888","label":"access.redhat.com/security/cve/CVE-2008-0888","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0888","label":"www.cve.org/CVERecord?id=CVE-2008-0888","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0888","label":"nvd.nist.gov/vuln/detail/CVE-2008-0888","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-0888","label":"security-tracker.debian.org/tracker/CVE-2008-0888","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-03-17T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-08-26T12:17:22.176Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:07:38.808Z","stale":false,"partial":false}}