Mariner Release Notes Security Update secure@microsoft.com The Microsoft Security Response Center (MSRC) identifies, monitors, resolves, and responds to security incidents and Microsoft software security vulnerabilities. For more information, see http://www.microsoft.com/security/msrc. 2008-Mar 2008-Mar Final 1.0 5 2026-08-12T21:19:19 Mariner Release Notes 2008-03-02T00:00:00 2026-08-12T21:19:19 <p>Mariner Release notes</p> The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. cm1 unzip 6.0-16 on CBL Mariner 1.0 cbl2 unzip 6.0-19 on CBL Mariner 2.0 azl3 unzip 6.0-20 on Azure Linux 3.0 azl3 unzip 6.0-22 on Azure Linux 3.0 cbl2 unzip 6.0-19 on CBL Mariner 2.0 azl3 unzip 6.0-20 on Azure Linux 3.0 cm1 unzip 6.0-16 on CBL Mariner 1.0 azl3 unzip 6.0-22 on Azure Linux 3.0 The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner redhat Yes CVE-2008-0888 16921-16820 16845-16823 16846-17084 18861-17084 16921-16820 16845-16823 16846-17084 18861-17084 Critical 16921-16820 Critical 16845-16823 Critical 16846-17084 Critical 18861-17084 CBL-Mariner Releases 16921-16820 No Security Update 6.0-16 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16921-16820 CBL-Mariner Releases CBL-Mariner Releases 16845-16823 No Security Update 6.0-19 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16845-16823 CBL-Mariner Releases CBL-Mariner Releases 16846-17084 18861-17084 No Security Update 6.0-20 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16846-17084 18861-17084 CBL-Mariner Releases 1.0 2020-09-25T00:00:00 <p>Information published.</p> 1.1 2021-12-16T00:00:00 <p>Added unzip to CBL-Mariner 2.0</p> 1.2 2024-06-30T07:00:00 <p>Information published.</p> 1.3 2026-02-20T22:49:04 <p>Information published.</p> 2.0 2026-08-12T21:19:19 <p>Information published.</p>