Security Advisory: zlib [2003:033]

[aru]

MandrakeSoft Security Advisory MDKSA-2003:033 : zlib

 

March 18th, 2003

Updated zlib packages fix buffer overrun vulnerability

 

Richard Kettlewell discovered a buffer overflow vulnerability in the zlib library's gzprintf() function. This can be used by attackers to cause a denial of service or possibly even the execution of arbitrary code. Our thanks to the OpenPKG team for providing a patch which adds the necessary configure script checks to always use the secure vsnprintf(3) and snprintf(3) functions, and which additionally adjusts the code to correctly take into account the return value of vsnprintf(3) and snprintf(3).

 

 

The released versions of Mandrake GNU/Linux affected are:

• 7.2

 

[*] 8.0

 

[*] 8.0/PPC

 

[*] 8.1

 

[*] 8.1/IA64

 

[*] 8.2

 

[*] 8.2/PPC

 

[*] 9.0

 

[*] Single Network Firewall 7.2

 

[*] Multi Network Firewall 8.2

 

[*] Corporate Server 2.1

 

 

All the information about this advisory is available at:

www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:033

 

This stuff was posted automatically by aru