On Thu, Jan 21, 2010 at 7:22 AM, Ronald van Haren <firstname.lastname@example.org> wrote:
> On Thu, Jan 21, 2010 at 12:35 PM, Allan McRae <email@example.com> wrote:
>> Upstream update. *Fixes a CVE:
>> *gzip -d could segfault and/or clobber the stack, possibly leading to
>> *arbitrary code execution. *This affects x86_64 but not 32-bit systems.
>> *This fixes CVE-2010-0001.
>> *For more details, see http://bugzilla.redhat.com/554418
>> *gzip -d would fail with a CRC error for some valid inputs.
>> *So far, the only valid input known to exhibit this failure was
>> *compressed "from FAT filesystem (MS-DOS, OS/2, NT)". *In addition,
>> *to trigger the failure, your memcpy implementation must copy in
>> *the "reverse" order.
>> Signoff both,
> signoff x86_64