DebianDEBIAN:DLA-1505-1:59582[SECURITY] [DLA 1505-1] zutils security update
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
58.9%
Package : zutils
Version : 1.3-4+deb8u1
CVE ID : CVE-2018-1000637
Debian Bug : 902936
zutils version prior to version 1.8-pre2 contains a buffer
overflow vulnerability in zcat which happened with some
input files when the '-v, --show-nonprinting' option was
used (or indirectly enabled). This can result in potential
denial of service or arbitrary code execution. This attack
appear is exploitable via the victim openning a crafted
compressed file and has been fixed in 1.8-pre2.
For Debian 8 "Jessie", this problem has been fixed in
version 1.3-4+deb8u1.
We recommend that you upgrade your zutils packages.
Further information about Debian LTS security advisories,
how to apply these updates to your system and frequently
asked questions can be found at: https://wiki.debian.org/LTS
Regards,
Daniel
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 8 | armhf | zutils | < 1.3-4+deb8u1 | zutils_1.3-4+deb8u1_armhf.deb |
| Debian | 9 | armel | zutils-dbg | < 1.5-5+deb9u1 | zutils-dbg_1.5-5+deb9u1_armel.deb |
| Debian | 9 | s390x | zutils | < 1.5-5+deb9u1 | zutils_1.5-5+deb9u1_s390x.deb |
| Debian | 8 | amd64 | zutils | < 1.3-4+deb8u1 | zutils_1.3-4+deb8u1_amd64.deb |
| Debian | 8 | armhf | zutils-dbg | < 1.3-4+deb8u1 | zutils-dbg_1.3-4+deb8u1_armhf.deb |
| Debian | 9 | armel | zutils | < 1.5-5+deb9u1 | zutils_1.5-5+deb9u1_armel.deb |
| Debian | 9 | armhf | zutils | < 1.5-5+deb9u1 | zutils_1.5-5+deb9u1_armhf.deb |
| Debian | 8 | amd64 | zutils-dbg | < 1.3-4+deb8u1 | zutils-dbg_1.3-4+deb8u1_amd64.deb |
| Debian | 9 | s390x | zutils-dbg | < 1.5-5+deb9u1 | zutils-dbg_1.5-5+deb9u1_s390x.deb |
| Debian | 9 | arm64 | zutils | < 1.5-5+deb9u1 | zutils_1.5-5+deb9u1_arm64.deb |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
58.9%