Package name
gzip
Date
2006-09-20
Advisory ID
MDKSA-2006:167
Affected versions
CS4.0 x86_64 , MNF2.0 i586 , 2006.0 i586 , CS4.0 i586 , CS3.0 x86_64 , CS3.0 i586 , 2006.0 x86_64

Problem description

NULL Dereference (CVE-2006-4334)

A stack modification vulnerability (where a stack buffer can be
modified out of bounds, but not in the traditional stack overrun sense)
exists in the LZH decompression support of gzip. (CVE-2006-4335)

A .bss buffer underflow exists in gzip's pack support, where a loop
from build_tree() does not enforce any lower bound while constructing
the prefix table. (CVE-2006-4336)

A .bss buffer overflow vulnerability exists in gzip's LZH support, due
to it's inability to handle exceptional input in the make_table()
function, a pathological decoding table can be constructed in such a
way as to generate counts so high that the rapid growth of `nextcode`
exceeds the size of the table[] buffer. (CVE-2006-4337)

A possible infinite loop exists in code from unlzh.c for traversing the
branches of a tree structure. This makes it possible to disrupt the
operation of automated systems relying on gzip for data decompression,
resulting in a minor DoS. (CVE-2006-4338) Updated packages have been
patched to address these issues.

Updated packages

CS4.0 x86_64

 940923c3880d84e597a8507155cc81fd  corporate/4.0/x86_64/gzip-1.2.4a-15.3.20060mlcs4.x86_64.rpm 
 71ee80833c3dd784d1a604698376b0a4  corporate/4.0/SRPMS/gzip-1.2.4a-15.3.20060mlcs4.src.rpm

MNF2.0 i586

 c60c6b5559a4f6f3c9fa811433f2bce6  mnf/2.0/i586/gzip-1.2.4a-13.5.M20mdk.i586.rpm 
 b68cb1643f57f850fef0224788f95795  mnf/2.0/SRPMS/gzip-1.2.4a-13.5.M20mdk.src.rpm

2006.0 i586

 6da645cd7adea1af99a3fcd11e5a3fbc  2006.0/i586/gzip-1.2.4a-15.3.20060mdk.i586.rpm 
 d4acb45be5d2683759578a37d1b8435f  2006.0/SRPMS/gzip-1.2.4a-15.3.20060mdk.src.rpm

CS4.0 i586

 da60be3f5d293fa5c246edf6ae256420  corporate/4.0/i586/gzip-1.2.4a-15.3.20060mlcs4.i586.rpm 
 71ee80833c3dd784d1a604698376b0a4  corporate/4.0/SRPMS/gzip-1.2.4a-15.3.20060mlcs4.src.rpm

CS3.0 x86_64

 7ed6fcfcaa6a43d5e6d055f72a7f7bc5  corporate/3.0/x86_64/gzip-1.2.4a-13.5.C30mdk.x86_64.rpm 
 6c4e3de8975f5f568c5a7a18e7946112  corporate/3.0/SRPMS/gzip-1.2.4a-13.5.C30mdk.src.rpm

CS3.0 i586

 6d80bed89cf647be72f127ed17c5359c  corporate/3.0/i586/gzip-1.2.4a-13.5.C30mdk.i586.rpm 
 6c4e3de8975f5f568c5a7a18e7946112  corporate/3.0/SRPMS/gzip-1.2.4a-13.5.C30mdk.src.rpm

2006.0 x86_64

 732d50ab4b4d7e18751f8a24026182d2  2006.0/x86_64/gzip-1.2.4a-15.3.20060mdk.x86_64.rpm 
 d4acb45be5d2683759578a37d1b8435f  2006.0/SRPMS/gzip-1.2.4a-15.3.20060mdk.src.rpm

References