[SECURITY] [DSA-308-1] New gzip packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 308-1 [email protected] http://www.debian.org/security/ Matt Zimmerman June 6th, 2003 http://www.debian.org/security/faq -...

DSA-308 gzip - insecure temporary files

Bulletin has no description...

CVE-2002-1245

Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program...

Bypassing TrendMicro InterScan VirusWall

Bypassing TrendMicro InterScan VirusWall Overview According to our tests, TrendMicro VirusWall can be bypassed when using : HTTP 1.1 chunked transfert encoding. HTTP 1.0 gzip content encoding for Windows platforms only. Description While HTTP/1.0 includes the Content-Encoding header, which...

CVE-2001-1228

Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server...

CVE-2001-1228

CVE-2001-1228 describes buffer overflows in gzip (notably versions from 1.2.4 and 1.3x and other releases) that could allow code execution via a long filename, potentially when gzip is used on an FTP server. Connected documents corroborate the vulnerability and point to advisories (e.g., Debian D...

CVE-2001-1228: Undefined Security Weakness

Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-1999-1332

Technical details about CVE-1999-1332 are not publicly provided in the connected documents you supplied; existing entries mention the vulnerability in gzexe but do not reveal affected versions, impact specifics, or fixes.

CVE-1999-1332: Undefined Security Weakness

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

[SECURITY] [DSA 100-1] New gzip packages fix potential buffer overflow

Attachment: pgp4dQewy4CjS.pgp Description: PGP message...

[SECURITY] [DSA 100-1] New gzip packages fix potential buffer overflow

Attachment: pgp4dQewy4CjS.pgp Description: PGP message...

Переполнение буфера в gzip некоторых версий linux

Переполнение буфера при длинном аргументе. Многие серверные и suid программы импользуют gzip...

New bugs discovered!

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++GOBBLES+SECURITY+RESEARCH+TEAM+INCORPORATED++++++++++++++ ALERT! ALERT! MUCH NEW BUFFEROVERFLOW FOUND IN /BIN/GZIP! ALERT! ALERT! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Researche...

CVE-2001-1228

Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

DEBIAN-CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

[SECURITY] New versions of gzip available

We were told by Michal Zalewski that gzexe as shipped with gzip uses an unsecure method decompressing executables on the fly opening a way of calling arbitrary programs. Newer versions for bo and hamm are fixing this. We recommend you upgrade your gzip package if youre using the gzexe method. dpk...