FreeBSD : gzip -- multiple vulnerabilities (11a84092-8f9f-11db-ab33-000e0c2e438a)

High Nessus Plugin ID 25437


The remote FreeBSD host is missing a security-related update.


Problem Description Multiple programming errors have been found in gzip which can be triggered when gzip is decompressing files. These errors include insufficient bounds checks in buffer use, a NULL pointer dereference, and a potential infinite loop. Impact The insufficient bounds checks in buffer use can cause gzip to crash, and may permit the execution of arbitrary code. The NULL pointer deference can cause gzip to crash. The infinite loop can cause a Denial-of-Service situation where gzip uses all available CPU time.
Workaround No workaround is available.


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 25437

File Name: freebsd_pkg_11a840928f9f11dbab33000e0c2e438a.nasl

Version: $Revision: 1.10 $

Type: local

Published: 2007/06/07

Modified: 2016/04/28

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:ND/RC:UR

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:gzip, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2006/12/19

Vulnerability Publication Date: 2006/09/19

Reference Information

CVE: CVE-2006-4334, CVE-2006-4335, CVE-2006-4336, CVE-2006-4337, CVE-2006-4338

OSVDB: 29004, 29005, 29006, 29007, 29008

FreeBSD: SA-06:21.gzip