Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006:8] cvs now uses new version of ZLib

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: George Sherwood <pilot AT beernabeer.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006:8] cvs now uses new version of ZLib
  • Date: Sun, 26 Feb 2006 09:53:49 -0500

Summary
============
CVS now uses version 1.2.3 of the ZLib compression libraries in order to
avoid two recently announced security vulnerabilities in them. Both may be
used for denial of service attacks and one may reportedly allow execution of
arbitrary code, though this is not confirmed. Please see the CERT
vulnerabilities advisories #238678 <http://www.kb.cert.org/vuls/id/238678> &
#680620 <http://www.kb.cert.org/vuls/id/680620> for more.

Impact
======
A remote attacker be able to exploit this vulnerability by supplying the
inflate() routine with specially crafted compressed data. As a result,
applications linked to the zlib library may abruptly and abnormally terminate
resulting in a denial-of-service condition. According to public reports, this
vulnerability can be exploited to execute arbitrary code, but we have not
confirmed this.

Solution:
=========

Update cvs as soon as possible to version 1.12.13. There are no
fixes for older versions available.

Resolution
==========
All cvs users should upgrade to the latest available version:
# scribe update
# cast -c cvs

References
============
http://ftp.gnu.org/non-gnu/cvs/source/feature/1.12.13/NEWS
http://www.kb.cert.org/vuls/id/238678
http://www.kb.cert.org/vuls/id/680620



  • [SM-Security] [SMGLSA-2006:8] cvs now uses new version of ZLib, George Sherwood, 02/26/2006

Archive powered by MHonArc 2.6.24.

Top of Page