PatchSiren

PatchSiren cyber security CVE debrief

CVE-2014-9913 Unzip Project CVE debrief

CVE-2014-9913 describes a buffer overflow in the list_files function in UnZip 6.0’s list.c. The documented impact is denial of service via a crash while handling archive content related to the compression method. NVD classifies the issue with low attack complexity and no confidentiality or integrity impact, but availability impact is present.

Vendor
Unzip Project
Product
Unzip
CVSS
MEDIUM 4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Teams that use Info-ZIP UnZip 6.0 to process untrusted archives, especially systems that automatically inspect, list, or unpack user-supplied files. Administrators should also care where crashes in archive-handling tools could interrupt workflows or batch processing.

Technical summary

NVD maps the vulnerable product to cpe:2.3:a:unzip_project:unzip:6.0 and assigns CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness is listed as CWE-119. The prose description says the bug is in list_files in list.c and can be triggered through vectors related to the compression method, resulting in a crash rather than a data exposure or code execution outcome in the supplied record.

Defensive priority

Medium. The issue is availability-focused and rated CVSS 4, but archive parsers are often exposed to untrusted input in automation, mail gateways, and user-facing file handling paths.

Recommended defensive actions

  • Identify where Info-ZIP UnZip 6.0 is deployed and whether it processes untrusted archives.
  • Prefer a patched or vendor-recommended replacement if available, or restrict use of the affected version.
  • Limit archive processing to trusted sources and isolate any systems that must inspect external archives.
  • Monitor for crashes in archive listing or unpacking workflows and treat repeated failures as security-relevant.
  • Use the supplied CVE and NVD records to confirm remediation status in your environment before relying on the tool.

Evidence notes

The core facts come from the NVD record: affected version cpe:2.3:a:unzip_project:unzip:6.0, CVSS vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and CWE-119. The NVD description states a buffer overflow in list_files in list.c can let remote attackers cause a denial of service via compression-method-related vectors. Related references include Openwall oss-security threads, a SecurityFocus BID entry, and an Ubuntu Launchpad issue tracker item. No exploit details are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2014-9913 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2014-9913

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2014-9913 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2014-9913

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.