Oval Definition:oval:org.mitre.oval:def:13018
Revision Date:2014-06-23Version:19
Title:DSA-1974-1 gzip -- several
Description:Several vulnerabilities have been found in gzip, the GNU compression utilities. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2624 Thiemo Nagel discovered a missing input sanitation flaw in the way gzip used to decompress data blocks for dynamic Huffman codes, which could lead to the execution of arbitrary code when trying to decompress a crafted archive. This issue is a reappearance of CVE-2006-4334 and only affects the lenny version. CVE-2010-0001 Aki Helin discovered an integer underflow when decompressing files that are compressed using the LZW algorithm. This could lead to the execution of arbitrary code when trying to decompress a crafted LZW compressed gzip archive. For the stable distribution, these problems have been fixed in version 1.3.12-6+lenny1. For the oldstable distribution, these problems have been fixed in version 1.3.5-15+etch1. For the testing distribution and the unstable distribution, these problems will be fixed soon. We recommend that you upgrade your gzip packages.
Family:unixClass:patch
Status:ACCEPTEDReference(s):CVE-2006-4334
CVE-2009-2624
CVE-2010-0001
DSA-1974-1
Platform(s):Debian GNU/Linux 4.0
Debian GNU/Linux 5.0
Product(s):gzip
Definition Synopsis
  • Release section
  • Debian GNU/Linux 5.0 is installed
  • AND Architecture section
  • Architecture independet section
  • Installed architecture is all
  • AND gzip-win32 DPKG is earlier than 1.3.12-6+lenny1
  • OR gzip DPKG is earlier than 1.3.12-6+lenny1
  • OR Release section
  • Debian GNU/Linux 4.0 is installed.
  • AND Supported architectures section
  • Installed architecture is s390
  • OR Installed architecture is amd64
  • OR Installed architecture is sparc
  • OR Installed architecture is arm
  • OR Installed architecture is i386
  • OR Installed architecture is ia64
  • OR Installed architecture is alpha
  • OR Installed architecture is powerpc
  • OR Installed architecture is mipsel
  • OR Installed architecture is hppa
  • AND gzip DPKG is earlier than 1.3.5-15+etch1
  • BACK