# CVE-2014-9913: Info-Zip UnZip buffer overflow in list_files

Source: https://junglewise.ai/threats/cve-2014-9913-info-zip-unzip-buffer-overflow-in-list-files  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2014-9913 · Severity: medium · CVSS 4 · Published 2017-01-18

A vulnerability in the Info-Zip UnZip utility could allow an attacker to crash the application. This occurs when the tool processes a specially crafted ZIP file with an unusual compression method value. While primarily a stability issue, it could disrupt automated workflows or services that rely on UnZip to process uploaded files.

Technologies: [Unzip Project Unzip](https://junglewise.ai/threats/technologies/unzip). Vendors: [Unzip Project](https://junglewise.ai/threats/vendors/unzip-project).

## Quick answers

**Is CVE-2014-9913 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-9913 being exploited in the wild.

**How severe is CVE-2014-9913?** Medium severity, with a CVSS score of 4, published 18 January 2017.

**Which products and versions are affected?** Info-Zip UnZip 6.0.

**Is there a fix for CVE-2014-9913?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2014-9913 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2014-9913?** Check whether you run Unzip Project Unzip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the list_files function within list.c of Info-Zip UnZip 6.0. The vulnerability is triggered when the program uses sprintf to write a compression method ID into a fixed-size 8-byte buffer (methbuf). Because the %03u format specifier does not limit the output length, a compression method value exceeding 999 (which can be up to 65535 in a 2-byte field) results in a buffer overflow. An attacker can exploit this by providing a malicious ZIP file, leading to a denial of service or potentially affecting other local variables on the stack. This issue is closely related to a similar overflow in zipinfo.c (CVE-2016-9844).

## Affected products

- Info-Zip UnZip 6.0

## Timeline

- 2014-11-03: disclosed: Initial discovery and public post to oss-security mailing list.
- 2017-01-18: advisory: NVD published the CVE record.

## References

- [http://www.openwall.com/lists/oss-security/2014/11/03/5](http://www.openwall.com/lists/oss-security/2014/11/03/5)
- [http://www.openwall.com/lists/oss-security/2016/12/05/13](http://www.openwall.com/lists/oss-security/2016/12/05/13)
- [http://www.openwall.com/lists/oss-security/2016/12/05/19](http://www.openwall.com/lists/oss-security/2016/12/05/19)
- [http://www.openwall.com/lists/oss-security/2016/12/05/20](http://www.openwall.com/lists/oss-security/2016/12/05/20)
- [http://www.securityfocus.com/bid/95081](http://www.securityfocus.com/bid/95081)
- [https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750](https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750)

## Related threats

- [Info-ZIP UnZip buffer overflow in zi_short function](https://junglewise.ai/threats/cve-2016-9844-info-zip-unzip-buffer-overflow-in-zi-short-function)