RHSA-2006:0667: gzip security update
The gzip package contains the GNU gzip data compression program.Tavis Ormandy of the Google Security Team discovered two denial of serviceflaws in the way gzip expanded archive files. If a victim expanded aspecially crafted archive, it could cause the gzip executable to hang orcrash. (CVE-2006-4334, CVE-2006-4338)Tavis Ormandy of the Google Security Team discovered several code executionflaws in the way gzip expanded archive files. If a victim expanded aspecially crafted archive, it could cause the gzip executable to crash orexecute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)Users of gzip should upgrade to these updated packages, which contain abackported patch and is not vulnerable to these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2006:0667?
The severity of RHSA-2006:0667 is classified as moderate due to the denial of service vulnerabilities.
How do I fix RHSA-2006:0667?
To fix RHSA-2006:0667, update the gzip package to version 1.3.3-16.rhel4 or later.
Which systems are affected by RHSA-2006:0667?
RHSA-2006:0667 affects Red Hat Enterprise Linux 4 systems that utilize the gzip package.
What type of vulnerabilities are described in RHSA-2006:0667?
RHSA-2006:0667 describes denial of service vulnerabilities that occur when expanding specially crafted gzip archive files.
Who discovered the vulnerabilities in RHSA-2006:0667?
The vulnerabilities in RHSA-2006:0667 were discovered by Tavis Ormandy of the Google Security Team.