Описание
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| dpkg | not-affected | woody | package | |
| dpkg | fixed | 1.13.11 | package | |
| zsync | fixed | 0.4.0-2 | package | |
| dump | not-affected | woody | package | |
| dump | no-dsa | sarge | package | |
| dump | fixed | 0.4b40-1 | package | |
| aide | not-affected | woody | package | |
| aide | fixed | 0.10-6.1.1 | package | |
| amd64-libs | not-affected | woody | package | |
| amd64-libs | fixed | 1.3 | package | |
| ia32-libs | not-affected | woody | package | |
| ia32-libs | fixed | 1.6 | package | |
| dar | not-affected | package | ||
| bacula | not-affected | woody | package | |
| bacula | fixed | 1.36.3-2 | package | |
| bacula | no-dsa | sarge | package | |
| sash | not-affected | woody | package | |
| sash | fixed | 3.7-6 | package | |
| libphysfs | not-affected | woody | package | |
| libphysfs | fixed | 1.0.0-5 | package | |
| oops | fixed | 1.5.23.cvs-3 | package | |
| rpm | not-affected | woody | package | |
| rpm | fixed | 4.0.4-31.1 | package | |
| rageircd | fixed | 2.0.0-3sid1 | package | |
| systemimager-ssh | not-affected | package | ||
| texmacs | not-affected | woody | package | |
| texmacs | fixed | 1:1.0.5-3 | package | |
| texmacs | no-dsa | sarge | package | |
| zlib | fixed | 1:1.2.2-7 | package | |
| pvpgn | fixed | 1.7.8-2 | package | |
| mysql-dfsg-4.1 | fixed | 4.1.13-1 | package | |
| mrtg | not-affected | package | ||
| rsync | not-affected | package |
Примечания
Several packages ship embedded copies of zlib, there are a lot probably more
Florian Weimer is doing a comprehensive audit using clamav
to search for static zlib signatures in binaries in Debian
Not all of the listed packages have been checked for actual
exploitability using this hole.
oldstable (woody) had zlib 1.1, which is not affected
You need to trust debs anyway, when installing them
aide only uses zlib to compress/decompress internal data
You need to trust rpms anyway, when installing them
see dannf's first bug comment; systemimager-ssh doesn't use compression
rsync upstream updated the internal zlib copy in 2.6.6 without real need,
as the included version was never affected, despite claiming them so.
EPSS
Связанные уязвимости
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
Уязвимость операционной системы openSUSE, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
EPSS