---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: zlib security update
Advisory ID: RHSA-2005:584-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-584.html
Issue date: 2005-07-21
Updated on: 2005-07-21
Product: Red Hat Enterprise Linux
Obsoletes: RHSA-2005:569
CVE Names:
CAN-2005-1849
- ---------------------------------------------------------------------
1. Summary:
Updated zlib packages that fix a buffer overflow are now available for Red
Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
Zlib is a general-purpose lossless data compression library that is used
by many different programs.
A previous zlib update, RHSA-2005:569 (
CAN-2005-2096) fixed a flaw in zlib
that could allow a carefully crafted compressed stream to crash an
application. While the original patch corrected the reported overflow,
Markus Oberhumer discovered additional ways a stream could trigger an
overflow. An attacker could create a carefully crafted compressed stream
that would cause an application to crash if the stream is opened by a user.
As an example, an attacker could create a malicious PNG image file that
would cause a Web browser or mail viewer to crash if the image is viewed.
The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned
the name
CAN-2005-1849 to this issue.
Note that the versions of zlib shipped with Red Hat Enterprise
Linux 2.1 and 3 are not vulnerable to this issue.
All users should update to these errata packages that contain a patch
from Mark Adler that corrects this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (
http://bugzilla.redhat.com/):
163037 -
CAN-2005-1849 zlib buffer overflow
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad zlib-1.2.1.2-1.2.src.rpm
i386:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
ia64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214 zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe zlib-devel-1.2.1.2-1.2.ia64.rpm
ppc:
d9cd4122eccc130ec2a6d7c64444c3b9 zlib-1.2.1.2-1.2.ppc.rpm
c2191b6f367b068c5aadad73bbf22c5c zlib-1.2.1.2-1.2.ppc64.rpm
961c16ee93912237b347328f73fa3c9b zlib-devel-1.2.1.2-1.2.ppc.rpm
235b2aec2af9595771b10218ec467635 zlib-devel-1.2.1.2-1.2.ppc64.rpm
s390:
7efc2375f317b93d57d360cd4ac5a296 zlib-1.2.1.2-1.2.s390.rpm
942b1745f31f9719a6c0a8d5c7fef689 zlib-devel-1.2.1.2-1.2.s390.rpm
s390x:
7efc2375f317b93d57d360cd4ac5a296 zlib-1.2.1.2-1.2.s390.rpm
2fddcbebe2083e23a16353719f241c44 zlib-1.2.1.2-1.2.s390x.rpm
942b1745f31f9719a6c0a8d5c7fef689 zlib-devel-1.2.1.2-1.2.s390.rpm
6797b66922691f00c5f6c1454c2522fe zlib-devel-1.2.1.2-1.2.s390x.rpm
x86_64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3 zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa zlib-devel-1.2.1.2-1.2.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad zlib-1.2.1.2-1.2.src.rpm
i386:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
x86_64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3 zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa zlib-devel-1.2.1.2-1.2.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad zlib-1.2.1.2-1.2.src.rpm
i386:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
ia64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214 zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe zlib-devel-1.2.1.2-1.2.ia64.rpm
x86_64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3 zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa zlib-devel-1.2.1.2-1.2.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad zlib-1.2.1.2-1.2.src.rpm
i386:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
ia64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214 zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe zlib-devel-1.2.1.2-1.2.ia64.rpm
x86_64:
30f929114a8ea2b081ce351d3d246d28 zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3 zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa zlib-devel-1.2.1.2-1.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2005-1849
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFC3+iyXlSAg2UNWIIRAuy4AKC/6S+MgKGu1gK0fMNTWySgFXxpXwCglkBU
BJqle8b0ZA+7+YBV8QSzI0U=
=xI56
-----END PGP SIGNATURE-----
