Lucene search
SuseSUSE-SA:2006:056HistorySep 26, 2006 - 1:43 p.m.
remote system compromise in gzip
2006-09-2613:43:14
lists.opensuse.org
7
0.076 Low
EPSS
Percentile
93.4%
The gzip tool does not handle some specific values correctly when unpacking archives. This leads to vulnerabilities like buffer overflows or infinite loops. Various different programs like mail clients, file explorer, etc. use gzip and if a user can be deveived to unpack the archive of an attacker these bugs can lead to remote system compromise. Thanks to Tavis Ormandy, Google Security Team for informing us about this issue.
Solution
The is no work-around known.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| SUSE Linux Enterprise Server | 10 | s390x | gzip | <Â 1.3.5-159.5 | gzip-1.3.5-159.5.s390x.rpm |
| openSUSE | 9.3 | i586 | gzip | <Â 1.3.5-140.2 | gzip-1.3.5-140.2.i586.rpm |
| openSUSE | 10.0 | ppc | gzip | <Â 1.3.5-144.2 | gzip-1.3.5-144.2.ppc.rpm |
| openSUSE | 10.1 | ppc | gzip | <Â 1.3.5-159.5 | gzip-1.3.5-159.5.ppc.rpm |
| openSUSE | 9.2 | i586 | gzip | <Â 1.3.5-139.2 | gzip-1.3.5-139.2.i586.rpm |
| openSUSE | 10.0 | x86_64 | gzip | <Â 1.3.5-144.2 | gzip-1.3.5-144.2.x86_64.rpm |
| openSUSE | 10.0 | i586 | gzip | <Â 1.3.5-144.2 | gzip-1.3.5-144.2.i586.rpm |
| openSUSE | 10.1 | i586 | gzip | <Â 1.3.5-159.5 | gzip-1.3.5-159.5.i586.rpm |
| openSUSE | 9.3 | x86_64 | gzip | <Â 1.3.5-140.2 | gzip-1.3.5-140.2.x86_64.rpm |
| openSUSE | 10.1 | x86_64 | gzip | <Â 1.3.5-159.5 | gzip-1.3.5-159.5.x86_64.rpm |
Related
nessus
nessus
openvas
openvas
HP-UX Update for Software Distributor (SD) HPSBUX02195
2009-05-05 00:00:00
Gentoo Security Advisory GLSA 200609-13 (gzip)
2008-09-24 00:00:00
SLES9: Security update for gzip
2009-10-10 00:00:00
securityvulns
securityvulns
Multiple gzip security vulnerabilities
2007-03-07 00:00:00
FreeBSD Security Advisory FreeBSD-SA-06:21.gzip
2006-09-19 00:00:00
redhat
redhat
(RHSA-2006:0667) gzip security update
2006-09-19 00:00:00
freebsd
freebsd
gzip -- multiple vulnerabilities
2006-09-19 00:00:00
centos
centos
gzip security update
2006-09-19 14:54:11
gzip security update
2006-09-19 23:19:38
debian
debian
[SECURITY] [DSA 1181-1] New gzip packages fix arbitrary code execution
2006-09-19 19:19:34
[SECURITY] [DSA 1974-1] New gzip packages fix arbitrary code execution
2010-01-20 14:16:48
gentoo
gentoo
gzip: Multiple vulnerabilities
2006-09-23 00:00:00
LHa: Multiple vulnerabilities
2006-11-28 00:00:00
oraclelinux
oraclelinux
Moderate gzip security update
2006-11-30 00:00:00
osv
osv
gzip
2006-09-19 00:00:00
gzip - arbitrary code execution
2010-01-20 00:00:00
ubuntu
ubuntu
gzip vulnerabilities
2006-09-20 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-06:21.gzip
2006-09-19 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 6 package lha version 2:1.14i-alt2
2007-04-15 00:00:00
slackware
slackware
[slackware-security] gzip
2006-09-19 21:15:29
veracode
veracode
Buffer Underflow
2020-04-10 00:15:01
Denial Of Service (DoS)
2020-04-10 00:15:00
Arbitrary Code Execution
2020-04-10 00:15:00
cve
cve
cert
cert
gzip NULL dereference in huft_build()
2006-09-19 00:00:00
gzip contains a buffer underflow
2006-09-19 00:00:00
gzip contains an array out-of-bounds vulnerability in make_table()
2006-09-19 00:00:00
debiancve
debiancve
ubuntucve
ubuntucve
checkpoint_advisories
checkpoint_advisories
GNU gzip LZH Decompression make_table Stack Modification (CVE-2006-4335)
2010-03-31 00:00:00
fedora
fedora
[SECURITY] Fedora Core 5 Update: lha-1.14i-20
2007-05-31 13:12:41
prion
prion
Design/Logic Flaw
2010-01-29 18:30:00
Design/Logic Flaw
2007-05-31 23:30:00
seebug
seebug
Apple Mac OS X 2006-007ććšć€äžȘćźć
šæŒæŽ
2006-11-29 00:00:00