CVE-2008-0888: unzip: free() called for uninitialized or already freed pointer

Severity: Critical

CVSS Score: 9.3

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.