Bug 1312905

Summary:	gzip: Double free or corruption in zcat
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, cbuissar, pstodulk, slawomir
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-19 12:27:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1312906
Bug Blocks:	1312907

Description Adam Mariš 2016-02-29 13:46:11 UTC

Possible double free vulnerability was found in zcat when performing lsinitramfs on initrd which includes Intel microcode.

Debian bug:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816154

Comment 1 Adam Mariš 2016-02-29 13:46:29 UTC

Created gzip tracking bugs for this issue:

Affects: fedora-all [bug 1312906]

Comment 7 Cedric Buissart 2016-05-19 12:27:05 UTC

So far, all attempts by Red Hat Product Security to reproduce this issue have failed and all the currently available information has been exhausted.
Thus, this issue will be closed as "INSUFFICIENT_DATA" until further information becomes available. 
If you have additional information, please contact us via secalert"