Red Hat Security AdvisoryRHSA-2006:0667
gzip security update
Released 2006-09-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 gzip-1.3.3-13.rhel3, gzip-1.3.3-13.rhel3.i386
- Red Hat Enterprise Linux AS version 3 gzip-1.3.3-13.rhel3, gzip-1.3.3-13.rhel3.i386, gzip-1.3.3-13.rhel3.ia64 +1
- Red Hat Enterprise Linux AS version 4 gzip-1.3.3-16.rhel4, gzip-1.3.3-16.rhel4.i386, gzip-1.3.3-16.rhel4.ia64 +1
- Red Hat Enterprise Linux Desktop version 4 gzip-1.3.3-16.rhel4, gzip-1.3.3-16.rhel4.i386
- Red Hat Enterprise Linux ES version 3 gzip-1.3.3-13.rhel3, gzip-1.3.3-13.rhel3.i386, gzip-1.3.3-13.rhel3.ia64
- Red Hat Enterprise Linux ES version 4 gzip-1.3.3-16.rhel4, gzip-1.3.3-16.rhel4.i386, gzip-1.3.3-16.rhel4.ia64
- Red Hat Enterprise Linux WS version 3 gzip-1.3.3-13.rhel3, gzip-1.3.3-13.rhel3.i386, gzip-1.3.3-13.rhel3.ia64
- Red Hat Enterprise Linux WS version 4 gzip-1.3.3-16.rhel4, gzip-1.3.3-16.rhel4.i386, gzip-1.3.3-16.rhel4.ia64
Fixes 5 records
Priority MEDIUM 42
Buffer overflow in the make_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding table in a GZIP archive.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.06102 · Published 2006-09-19 · Partial fix
Priority MEDIUM 42
Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.0596 · Published 2006-09-19 · Partial fix
Priority MEDIUM 42
Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash) and pos…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05926 · Published 2006-09-19 · Partial fix
Priority LOW 30
Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) archive, which results in a NULL dereference.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04216 · Published 2006-09-19 · Fixed
Priority LOW 29
unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03904 · Published 2006-09-19 · Fixed
THREATIST.IORead the docs