National Cyber-Alert System

Vulnerability Summary for CVE-2003-0107

Overview

Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#142121

Name: VU#142121

Hyperlink:http://www.kb.cert.org/vuls/id/142121

External Source: XF

Name: zlib-gzprintf-bo(11381)

Type: Advisory

Hyperlink:http://www.iss.net/security_center/static/11381.php

External Source: BUGTRAQ

Name: 20030222 buffer overrun in zlib 1.1.4

Hyperlink:http://online.securityfocus.com/archive/1/312869

External Source: BUGTRAQ

Name: 20030223 poc zlib sploit just for fun :)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=104610337726297&w=2

External Source: CONFIRM

Name: http://lists.apple.com/mhonarc/security-announce/msg00038.html

Hyperlink:http://lists.apple.com/mhonarc/security-announce/msg00038.html

External Source: BID

Name: 6913

Hyperlink:http://www.securityfocus.com/bid/6913

External Source: REDHAT

Name: RHSA-2003:081

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-081.html

External Source: REDHAT

Name: RHSA-2003:079

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-079.html

External Source: OSVDB

Name: 6599

Hyperlink:http://www.osvdb.org/6599

External Source: MANDRAKE

Name: MDKSA-2003:033

Hyperlink:http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:033

External Source: SUNALERT

Name: 57405

Hyperlink:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57405

External Source: GENTOO

Name: GLSA-200303-25

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=104887247624907&w=2

External Source: BUGTRAQ

Name: 20030225 [sorcerer-spells] ZLIB-SORCERER2003-02-25

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=104620610427210&w=2

External Source: BUGTRAQ

Name: 20030224 Re: buffer overrun in zlib 1.1.4

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=104610536129508&w=2

External Source: CONECTIVA

Name: CLSA-2003:619

Hyperlink:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000619

External Source: NETBSD

Name: NetBSD-SA2003-004

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-004.txt.asc

External Source: CALDERA

Name: CSSA-2003-011.0

Hyperlink:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-011.0.txt