Red Hat Bugzilla – Bug 566486
update it to 1.4
Last modified: 2013-03-03 18:00:31 EST
* Noteworthy changes in release 1.4 (2010-01-20) [stable]
** Bug fixes
gzip -d could segfault and/or clobber the stack, possibly leading to
arbitrary code execution. This affects x86_64 but not 32-bit systems.
This fixes CVE-2010-0001.
For more details, see http://bugzilla.redhat.com/554418
gzip -d would fail with a CRC error for some valid inputs.
So far, the only valid input known to exhibit this failure was
compressed "from FAT filesystem (MS-DOS, OS/2, NT)". In addition,
to trigger the failure, your memcpy implementation must copy in
the "reverse" order.
Thanks for the info. I'll update it.
We already patched gzip to fix CVE-2010-0001 in all Fedora releases, so the current version is not vulnerable.
rawhide package has been updated