CVE-2014-9913

What it actually does

Buffer overflow in the list_files function allows crafted ZIP archives using specific compression methods to trigger memory corruption and crash the process.

Why it matters to the business

Service interruption when the affected unzip component processes malicious archives, with potential operational downtime for dependent applications such as packaged GitLab deployments; the vulnerability is long-public with no observed exploitation trend.

How an attack unfolds

An attacker crafts a ZIP file containing a compression method that overflows the list_files buffer, then supplies the archive to any process that invokes the vulnerable UnZip code path, resulting in a crash.

How to fix it

Upgrade affected installations to the fixed versions provided by vendors; for GitLab (Bitnami) this means version 13.9.7 or later, which includes a corrected UnZip component.

How to confirm the fix worked

Confirm the installed UnZip or dependent product version matches or exceeds the vendor-supplied fixed release and test that listing a sample archive no longer triggers a crash.

Typical attack path

1. Craft a malicious ZIP archive exploiting the compression-method vector in list.c
2. Deliver the archive to a target process or service that calls list_files
3. Trigger archive listing or extraction to induce the buffer overflow and denial of service

How to detect it

Review process crash logs and application error reports for sudden terminations during ZIP handling; correlate with inbound archive processing events.

What your security team should do

• Apply the vendor upgrade to GitLab (Bitnami) 13.9.7 or newer immediately
• Inventory all systems that embed or call Info-Zip UnZip 6.0 and schedule patching
• Monitor for any future EPSS increases or KEV inclusion given the public disclosure age