CVE-2008-0888: Apple Mac OS X

High severity, CVSS 9.3. EPSS: 6.3% chance of exploitation in the next 30 days.

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

Affected products

• Apple Mac OS X: before 10.6.3 (fixed in 10.6.3)
• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only; version 7.10 only
• Debian Debian Linux: version 4.0 only
• Unzip Project Unzip: before 6.0 (fixed in 6.0)

Published 2008-03-17. Last modified 2026-06-16.