On Thu, Jan 21, 2010 at 7:22 AM, Ronald van Haren <[email protected]> wrote: > On Thu, Jan 21, 2010 at 12:35 PM, Allan McRae <[email protected]> wrote: >> Upstream update. Fixes a CVE: >> >> gzip -d could segfault and/or clobber the stack, possibly leading to >> arbitrary code execution. This affects x86_64 but not 32-bit systems. >> This fixes CVE-2010-0001. >> For more details, see http://bugzilla.redhat.com/554418 >> >> gzip -d would fail with a CRC error for some valid inputs. >> So far, the only valid input known to exhibit this failure was >> compressed "from FAT filesystem (MS-DOS, OS/2, NT)". In addition, >> to trigger the failure, your memcpy implementation must copy in >> the "reverse" order. >> >> >> Signoff both, >> Allan >> > > signoff x86_64 > > Ronald >
signoff both
