Информационная безопасность
[RU] switch to English


Многочисленные уязвимости в gzip (multiple bugs)
дополнено с 19 сентября 2006 г.
Опубликовано:7 марта 2007 г.
Источник:
SecurityVulns ID:6626
Тип:библиотека
Уровень опасности:
7/10
Описание:Переполнение буфера, адресация по нулевому указателю, вечный цикл.
Затронутые продукты:gzip : gzip 1.3
CVE:CVE-2006-4338 (unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.)
 CVE-2006-4337 (Buffer overflow in the make_table function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding table in a GZIP archive.)
 CVE-2006-4336 (Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.)
 CVE-2006-4335 (Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write, aka a "stack modification vulnerability.")
 CVE-2006-4334 (Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) archive, which results in a NULL dereference.)
Оригинальный текстdocumentHP, [security bulletin] HPSBUX02195 SSRT061237 rev.1 - HP-UX Running Software Distributor (SD), Remote Denial of Service (DoS) (07.03.2007)
 documentFREEBSD, FreeBSD Security Advisory FreeBSD-SA-06:21.gzip (19.09.2006)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород