[SECURITY] [DSA 763-1] New zlib packages fix buffer overflow

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] [DSA 763-1] New zlib packages fix buffer overflow
From: Michael Stone <mstone@xxxxxxxxxxxxxxxxxx>
Date: Thu, 21 Jul 2005 04:23:53 +0200
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mail-followup-to: bugtraq@xxxxxxxxxxxxxxxxx
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Old-return-path: <mstone@xxxxxxxxxxxxxxxxxx>
Priority: urgent
Reply-to: listadmin@xxxxxxxxxxxxxxxxx
Resent-cc: recipient list not shown: ;
Resent-date: Wed, 20 Jul 2005 21:23:56 -0500 (CDT)
Resent-from: list@xxxxxxxxxxxxxxxxx (Mailing List Manager)
Resent-message-id: <gikE5C.A.tKB.8cw3CB@murphy>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA 763-1                   security@xxxxxxxxxx
http://www.debian.org/security/                            Michael Stone
July 20, 2005                         http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : zlib
Vulnerability  : buffer overflow
Problem type   : remote DoS
Debian-specific: no
CVE ID         : CAN-2005-1849

Markus Oberhumer discovered a flaw in the way zlib, a library used for
file compression and decompression, handles invalid input. This flaw can
cause programs which use zlib to crash when opening an invalid file.

This problem does not affect the old stable distribution (woody).

For the current stable distribution (sarge), this problem has been fixed
in version 1.2.2-4.sarge.2.

For the unstable distribution (sid), this problem has been fixed in
version 1.2.3-1. 

We recommend that you upgrade your zlib package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 3.1 (stable)
- -------------------

  Stable was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel, 
powerpc, s390 and sparc.

  Source archives:

    http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2.orig.tar.gz
      Size/MD5 checksum:   430700 d43dabe3d374e299f2631c5fc5ce31f5
    http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.dsc
      Size/MD5 checksum:      807 e3fa0febf789e5c758d43476199825fd
    
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.diff.gz
      Size/MD5 checksum:    14718 e733bcc48ade3c675bc62a2554e2a453

  alpha architecture (DEC Alpha)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_alpha.deb
      Size/MD5 checksum:   533980 950f2426191fd20fa1a0a1d975c5285d
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_alpha.udeb
      Size/MD5 checksum:    57220 1d97d651c5fb317b435ca4b4e03df7f0
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_alpha.deb
      Size/MD5 checksum:    82078 804c8d3a9b53373fa8693ea4b5db059e
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_alpha.deb
      Size/MD5 checksum:    30566 128b7f15f363185d05471bdd99fd4039

  arm architecture (ARM)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_arm.udeb
      Size/MD5 checksum:    42196 cec7d515976e1269116df86d58976ef1
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_arm.deb
      Size/MD5 checksum:   498234 80358e0e95f2be93600919065d31515c
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_arm.deb
      Size/MD5 checksum:    66728 0f055650a3092f0782bd00e10c78a64d
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_arm.deb
      Size/MD5 checksum:    25286 6a7931194287cc37f44f3a050ca1e945

  hppa architecture (HP PA RISC)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_hppa.deb
      Size/MD5 checksum:    70420 cb03981137f73dd2fb9a2a2cc40f2d18
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_hppa.udeb
      Size/MD5 checksum:    45430 7344c8007baae367ba7c8c4c72cfda68
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_hppa.deb
      Size/MD5 checksum:   512584 920721beba8dd6edc1c476b83bba74a0
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_hppa.deb
      Size/MD5 checksum:    29308 bd0d18dbaf6e9edaabcbce52528cc195

  i386 architecture (Intel ia32)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_i386.udeb
      Size/MD5 checksum:    38402 764ca5f9b9f9fa58c776678225ea8a4b
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_i386.deb
      Size/MD5 checksum:    63080 f1d25909fcc26fb653ff92083e3c6b1c
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_i386.deb
      Size/MD5 checksum:    25780 857be9a5220d54c222ded9c4faff6a22
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_i386.deb
      Size/MD5 checksum:   488024 dd74347cf85d778238ada4e5b42f8642

  ia64 architecture (Intel ia64)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_ia64.deb
      Size/MD5 checksum:    93462 6ed01ecbd1f214aa7fee259285944ea7
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_ia64.deb
      Size/MD5 checksum:   553666 a54eb90a0ac7ffef0460aed3d7f558c7
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_ia64.udeb
      Size/MD5 checksum:    68610 56f859f0d990f5b9869dc999c3d0230d
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_ia64.deb
      Size/MD5 checksum:    39258 7f0813ae8c8c9208d7ff68139c984f08

  m68k architecture (Motorola Mc680x0)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_m68k.deb
      Size/MD5 checksum:    24078 8e79779625dd37e03839668cf9946fc4
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_m68k.udeb
      Size/MD5 checksum:    34184 e7e987a0190218c343005f0e08ab130d
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_m68k.deb
      Size/MD5 checksum:    58884 c453ee8596ab35f83913a1a5652c6a7f
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_m68k.deb
      Size/MD5 checksum:   486102 29f51d071a8d50feb22ea66351039521

  mips architecture (MIPS (Big Endian))

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_mips.deb
      Size/MD5 checksum:    68822 bf7815238c0cb6f79f0296d89b2fe9a8
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_mips.deb
      Size/MD5 checksum:    31564 3ad12bca5cbd9e9818f5bc592813e149
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_mips.udeb
      Size/MD5 checksum:    44064 3dd3202a819d9f0cceda522e22c72d0a
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_mips.deb
      Size/MD5 checksum:   510282 8c2496dd52057a439d363b113245ad6e

  mipsel architecture (MIPS (Little Endian))

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_mipsel.deb
      Size/MD5 checksum:    69152 9e2754cc95ad0981969a683317e098cb
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_mipsel.deb
      Size/MD5 checksum:    31538 7b2548f4afb248be93d4dfbb3e76ff93
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_mipsel.deb
      Size/MD5 checksum:   509596 630a54c28569edbb2137831993d58e9e
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_mipsel.udeb
      Size/MD5 checksum:    44320 3f8f84d2c70973d46af65ef9a4a0cc07

  powerpc architecture (PowerPC)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_powerpc.deb
      Size/MD5 checksum:    30008 543bcd8e27d7899d2df07dd2ba9fabf6
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_powerpc.deb
      Size/MD5 checksum:    69670 9bc554e8b2783e93c80c7545b267dac0
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_powerpc.deb
      Size/MD5 checksum:   522700 14660718b619efe6022e70be92cfb297
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_powerpc.udeb
      Size/MD5 checksum:    44796 a4469df0bfa2c207a5670cf72d6618a8

  s390 architecture (IBM S/390)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_s390.udeb
      Size/MD5 checksum:    42554 8e3b601e51c37543f487e7bfdbdd0fae
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_s390.deb
      Size/MD5 checksum:    27226 edd658b54958ac949e03b18a16c16701
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_s390.deb
      Size/MD5 checksum:    67080 1573e6dac04a89f6112bb49841f67907
    
http://security.debian.org/pool/updates/main/z/zlib/lib64z1_1.2.2-4.sarge.2_s390.deb
      Size/MD5 checksum:    52628 16afd72e2349e5d142cf6f4650a93478
    
http://security.debian.org/pool/updates/main/z/zlib/lib64z1-dev_1.2.2-4.sarge.2_s390.deb
      Size/MD5 checksum:    55560 f06d56fab2f10b1b66924d6c3797a51b
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_s390.deb
      Size/MD5 checksum:   539004 e503ff8b0920cf33003f269cde722575

  sparc architecture (Sun SPARC/UltraSPARC)

    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_sparc.deb
      Size/MD5 checksum:   498926 0417611b01583d97ae0e51538094f231
    
http://security.debian.org/pool/updates/main/z/zlib/lib64z1-dev_1.2.2-4.sarge.2_sparc.deb
      Size/MD5 checksum:    57366 ce0e121289f3a11869bd11d74794c784
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_sparc.udeb
      Size/MD5 checksum:    42394 cef807ffdbab860caf36f46fd0e35e1a
    
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_sparc.deb
      Size/MD5 checksum:    66898 e02dc0d42b21a600f3fc771095372e64
    
http://security.debian.org/pool/updates/main/z/zlib/lib64z1_1.2.2-4.sarge.2_sparc.deb
      Size/MD5 checksum:    54566 d5bc984dbbffe1b49119c66f4f23073e
    
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_sparc.deb
      Size/MD5 checksum:    25810 507c188be5a90ed4d97ba6a7f92daf60

- 
-------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQCVAwUBQt8CTA0hVr09l8FJAQK+OwP+Lpeo+gzV00uKJxFkpJ2MF/GdL4SGB1z2
44au7NooESKIBvZvyHgRyI6MYSJhu4+1+Bd0cgsmBaAAUWHFPng1wRO/yAggaQgC
tIfjjgVEpliVCOAnV/7M2pifq7G/y4sgrp66vjDd6gzDUsqnTpedaryf/XYBQGKZ
e3TpqikSiQo=
=56rx
-----END PGP SIGNATURE-----

Prev by Date: Re: ICMP-based blind performance-degrading attack
Next by Date: Peter Gutmann data deletion theaory?
Previous by thread: [SECURITY] [DSA 764-1] New cacti packages fix several vulnerabilities
Next by thread: Peter Gutmann data deletion theaory?
Index(es):
- Date
- Thread