huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2009-3490: wget: incorrect verification of SSL certificate with NUL in name
Component: wget
Severity: Moderate
Public date: 2009-08-12T00:00:00+00:00

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


Affected upstream versions: n/a
Upstream repository: https://hg.addictivecode.org/wget/mainline
Upstream fix commit: 1eab157d3be7
CVE-2009-3547: kernel: fs: pipe.c null pointer dereference
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2009-10-14T00:00:00+00:00

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ad3960243e55320d74195fb85c975e0a8cc4466c
CVE-2009-3604: xpdf/poppler: Splash:: drawImage integer overflow and missing allocation return value check
Component: xpdf/poppler
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-10-14T00:00:00+00:00

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.11.0
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: 9cf2325fb2
CVE-2009-3612: kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
Component: kernel
Severity: Moderate
Public date: 2009-10-08T00:00:00+00:00

The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3 due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed.

For further information about the Errata Support Policy, visit: https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ad61df918c44316940404891d5082c63e79c256a
CVE-2009-3613: kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500
Component: kernel
Severity: Important
Public date: 2007-11-28T00:00:00+00:00

The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 97d477a914b146e7e6722ded21afa79886ae8ccd
CVE-2009-3620: kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2009-08-30T00:00:00+00:00

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7dc482dfeeeefcfd000d4271c4626937406756d7
CVE-2009-3621: kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket
Component: kernel
Severity: Moderate
Public date: 2009-10-19T00:00:00+00:00

net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed.

For further information about Errata Support Policy, visit: https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/davem/net-2.6.git
Upstream fix commit: 77238f2b942b38ab4e7f3aced44084493e4a8675
CVE-2009-3722: KVM: Check cpl before emulating debug register access
Component: KVM
Severity: Moderate
Public date: 2009-09-10T00:00:00+00:00

The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application.

Statement: Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3722

The Red Hat Product Security has rated this issue as having moderate security impact, a future update will address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 0a79b009525b160081d75cef5dbf45817956acf2
CVE-2009-3726: kernel: nfsv4: kernel panic in nfs4_proc_lock()
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2008-10-22T00:00:00+00:00

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3 did not have support for NFSv4, and therefore is not affected by this issue. It was addressed in Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0474.html, https://rhn.redhat.com/errata/RHSA-2009-1670.html and https://rhn.redhat.com/errata/RHSA-2009-1635.html respectively.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.31
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d953126a28f97ec965d23c69fd5795854c048f30
CVE-2009-3736: libtool: libltdl may load and execute code from a library in the current directory
Component: libtool
Severity: Moderate
Public date: 2009-11-16T00:00:00+00:00

ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/libtool.git
Upstream fix commit: 29b48580df75f0c5baa2962548a4c101ec7ed7ec
CVE-2009-3889: kernel: megaraid_sas permissions in sysfs
Component: kernel
Severity: Moderate
Public date: 2009-09-28T00:00:00+00:00

The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 3, as it does not implement the sysfs file system ("/sys/"), through which dbg_lvl file is exposed by the megaraid_sas driver.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.27
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46
CVE-2009-3909: Gimp: Integer overflow in the PSD image file plugin
Component: Gimp
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-11-17T00:00:00+00:00

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

Statement: Vulnerable. This issue affects gimp packages in Red Hat Enterprise Linux 4 and 5. This issue does not affect gimp package in Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Upstream repository: https://git.gnome.org/cgit/gimp
Upstream fix commit: 9cc8d78ff33b7a36852b74e64b427489cad44d0e
CVE-2009-4005: kernel: isdn: hfc_usb: fix read buffer overflow
Component: kernel
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2009-11-04T00:00:00+00:00

The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 5, and Red Hat Enterprise MRG did not include support for the HiSax ISDN driver for Colognechip HFC-S USB chip, and therefore were not affected by this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 286e633ef0ff5bb63c07b4516665da8004966fec
CVE-2009-4021: kernel: fuse: prevent fuse_put_request on invalid pointer
Component: kernel
Severity: Important
Public date: 2009-10-22T00:00:00+00:00

The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.

Statement: Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2009-4021

The Linux kernel packages as shipped with Red Hat Enterprise Linux 3 and 4 do not include support for FUSE, and therefore are not affected by this issue.

A future kernel update for Red Hat Enterprise MRG will address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f60311d5f7670d9539b424e4ed8b5c0872fc9e83
CVE-2009-4027: kernel: mac80211: fix spurious delBA handling
Component: kernel
Severity: Important
CWE: CWE-617 (Reachable Assertion)
Public date: 2009-11-30T00:00:00+00:00

Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 as they do not have support for the mac80211 framework.

It did not affect the version of the Linux kernel as shipped with Red Hat Enterprise MRG as they do not include the upstream patch that introduced this vulnerability.

A future update will address this flaw in Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7
CVE-2009-4031: kernel: KVM: x86 emulator: limit instructions to 15 bytes
Component: kernel
Severity: Moderate
Public date: 2009-11-24T00:00:00+00:00

The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/linux/kernel/git/avi/kvm.git
Upstream fix commit: e42d9b8141d1f54ff72ad3850bb110c95a5f3b88
CVE-2009-4138: kernel: firewire: ohci: handle receive packets with a data length of zero
Component: kernel
Severity: Moderate
Public date: 2009-12-11T00:00:00+00:00

drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.

Statement: Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2009-4138

The Linux kernel packages as shipped with Red Hat Enterprise Linux 3 and 4 have a different (and older) implementation of the driver for OHCI 1394 controllers, which is not affected by this issue.

A future kernel update for Red Hat Enterprise MRG will address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54
CVE-2009-4141: kernel: create_elf_tables can leave urandom in a bad state
Component: kernel
Severity: Important
CWE: CWE-910 (Use of Expired File Descriptor)
Public date: 2009-12-16T00:00:00+00:00

Use-after-free vulnerability in the fasync_helper function in fs/fcntl.c in the Linux kernel before 2.6.33-rc4-git1 allows local users to gain privileges via vectors that include enabling O_ASYNC (aka FASYNC or FIOASYNC) on a locked file, and then closing this file.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG. Shipped kernels do not include upstream commit 233e70f4 that introduced the problem.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 53281b6d34d44308372d16acb7fb5327609f68b6
CVE-2009-4144: NetworkManager: WPA enterprise network not verified when certificate is removed
Component: NetworkManager
Severity: Moderate
Public date: 2009-12-08T00:00:00+00:00

NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network.


Affected upstream versions: n/a
Fixed upstream versions: 0.7.2.995
Upstream repository: https://git.gnome.org/browse/network-manager-applet
Upstream fix commit: 4020594dfbf566f1852f0acb36ad631a9e73a82b
CVE-2009-4145: NetworkManager: information disclosure by nm-connection-editor
Component: NetworkManager
Severity: Moderate
Public date: 2009-12-10T00:00:00+00:00

nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network.


Affected upstream versions: n/a
Fixed upstream versions: 0.7.2.995
Upstream repository: https://git.gnome.org/browse/network-manager-applet
Upstream fix commit: 56d87fcb86acb5359558e0a2ee702cfc0c3391f2
CVE-2009-4272: kernel: emergency route cache flushing leads to node deadlock
Component: kernel
Severity: Important
CWE: CWE-833 (Deadlock)
Public date: 2010-01-19T00:00:00+00:00

A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long.  NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG. Shipped kernels do not include upstream commits c6153b5b and 1080d709 that introduced the problem.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.31
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b6280b47a7a42970d098a3059f4ebe7e55e90d8d
CVE-2009-4307: kernel: ext4: avoid divide by zero when trying to mount a corrupted file system
Component: kernel
Severity: Low
Public date: 2009-11-23T00:00:00+00:00

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Statement: The Linux kernel packages as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG do not include support for EXT4, and therefore are not affected by this issue.

A future kernel update for Red Hat Enterprise Linux 5 will address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 503358ae01b70ce6909d19dd01287093f6b6271c
CVE-2009-4308: kernel: ext4: Avoid null pointer dereference when decoding EROFS w/o a journal
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2009-07-27T00:00:00+00:00

The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.

Statement: The Linux kernel packages as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG do not include support for EXT4, and therefore are not affected by this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 78f1ddbb498283c2445c11b0dfa666424c301803
CVE-2009-4895: kernel: tty->pgrp races
Component: kernel
Severity: Moderate
Public date: 2009-12-17T00:00:00+00:00

Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors, related to the put_tty_queue and __f_setown functions.  NOTE: the vulnerability was addressed in a different way in 2.6.32.9.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4 and 5. This issue was addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0161.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 703625118069f9f8960d356676662d3db5a9d116
CVE-2009-5017: Firefox: overlong UTF-8 seqence detection problem
Component: Firefox
Severity: Low
Public date: 2009-08-21T00:00:00+00:00

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-1.9.2
Upstream fix commit: e42c563313a0
CVE-2009-5029: glibc: __tzfile_read integer overflow to buffer overflow
Component: glibc
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-06-01T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.15
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 97ac2654b2d831acaa18a2b018b0736245903fd2
CVE-2009-5138: gnutls: incorrect handling of V1 intermediate certificates
Component: gnutls
Severity: Moderate
CWE: CWE-295 (Improper Certificate Validation)
Public date: 2009-01-09T00:00:00+00:00

GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

Statement: This issue did not affect the versions of gnutls as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Upstream repository: https://gitorious.org/gnutls/gnutls
Upstream fix commit: c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd
CVE-2009-5147: ruby: dlopen could open a library with tainted library name
Component: ruby
Severity: Low
CWE: CWE-267 (Privilege Defined With Unsafe Actions)
Public date: 2009-05-11T00:00:00+00:00

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future updates. 

For additional information, refer to the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v1_9_1_126
Upstream repository: https://github.com/ruby/ruby
Upstream fix commit: 4600cf725a86ce31266153647ae5aa1197b1215b
CVE-2010-0001: gzip: (64 bit) Integer underflow by decompressing LZW format files
Component: gzip
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2010-01-20T00:00:00+00:00

Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/gzip.git
Upstream fix commit: a3db5806d012082b9e25cc36d09f19cd736a468f