Bug 164578

Summary:	CAN-2005-1849 zlib buffer overflows (CAN-2005-2096)
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	perl-Compress-Zlib	Assignee:	Joe Orton <jorton>
Status:	CLOSED NOTABUG	QA Contact:	David Lawrence <dkl>
Severity:	high	Docs Contact:
Priority:	medium
Version:	4	CC:	perl-devel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,source=vendorsec,reported=20050630
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-07-28 21:05:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	430649, 430650

Description Josh Bressers 2005-07-28 20:46:09 UTC

perl-Compress-Zlib contains an internal version of the zlib source.  A number of
buffer overflow issues have been recently fixed in zlib.

See bug 163037 and bug 162391 for more information.


Ideally, we should build perl-Compress-Zlib to use the system zlib to avoid
having to rebuild it in the future.

Comment 1 Joe Orton 2005-07-28 20:58:01 UTC

It is built against the system zlib unless Something Is Wrong...

...
* Wed Apr 21 2004 Joe Orton <jorton> 1.33-5
- use system zlib

[root@pepsi ~]# ldd
/usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.so
        libz.so.1 => /usr/lib/libz.so.1 (0x007c1000)
        libc.so.6 => /lib/tls/libc.so.6 (0x003e6000)
        /lib/ld-linux.so.2 (0x009f6000)

Comment 2 Josh Bressers 2005-07-28 21:05:22 UTC

Yes, you are right.  I hadn't checked this myself.  mjc ran a tool over FC4 and
this one popped up.