REDHAT-BUG-514711
First published: Thu Jul 30 2009(Updated: )
A missing input sanitation flaw was found in the way gzip used to decompress data blocks for dynamic Huffman codes. A remote attacker could provide a specially-crafted gzip compressed data archive, which once opened by a local, unsuspecting user would lead to denial of service (gzip crash) or, potentially, to arbitrary code execution with the privileges of the user running gzip. Upstream patch: --------------- <a href="http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2">http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2</a> CVE Note: --------- This flaw reportedly exists due to re-introduction of <a href="https://access.redhat.com/security/cve/CVE-2006-4334">CVE-2006-4334</a> issue: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334</a> in upstream gzip version (originally fixed in gzip-v1.3.6, reintroduced later in gzip-v1.3.10 and fixed again with above commit -- in gzip-v.1.3.13). Credit: ------- Oulu University Secure Programming Group (OUSPG)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| gzip | >=1.3.10<1.3.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2
- https://access.redhat.com/security/cve/CVE-2006-4334
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334
- http://admin.fedoraproject.org/updates/gzip-1.3.12-14.fc12
- http://admin.fedoraproject.org/updates/gzip-1.3.12-10.fc11
- https://bugzilla.redhat.com/show_bug.cgi?id=514711
Frequently Asked Questions
What is the severity of REDHAT-BUG-514711?
The severity of REDHAT-BUG-514711 is significant as it allows for denial of service through gzip crashing.
How do I fix REDHAT-BUG-514711?
To fix REDHAT-BUG-514711, update GNU gzip to a version beyond 1.3.13.
What versions of gzip are affected by REDHAT-BUG-514711?
Versions of GNU gzip from 1.3.10 to 1.3.13 are affected by REDHAT-BUG-514711.
What type of vulnerability is REDHAT-BUG-514711?
REDHAT-BUG-514711 is a missing input sanitation flaw that can be exploited remotely.
Can REDHAT-BUG-514711 be exploited by local users?
No, REDHAT-BUG-514711 requires a remote attacker to exploit the vulnerability on a local, unsuspecting user.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-2624
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/gzip