National Cyber-Alert System

Vulnerability Summary for CVE-2005-2096

Overview

zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#680620

Name: VU#680620

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/680620

External Source: BID

Name: 14162

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/14162

External Source: REDHAT

Name: RHSA-2005:569

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-569.html

External Source: GENTOO

Name: GLSA-200509-18

Type: Advisory; Patch Information

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200509-18.xml

External Source: VUPEN

Name: ADV-2005-0978

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2005/0978

External Source: DEBIAN

Name: DSA-797

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2005/dsa-797

External Source: DEBIAN

Name: DSA-740

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2005/dsa-740

External Source: SUNALERT

Name: 101989

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101989-1

External Source: GENTOO

Name: GLSA-200507-05

Type: Advisory; Patch Information

Hyperlink:http://security.gentoo.org/glsa/glsa-200507-05.xml

External Source: SECUNIA

Name: 15949

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/15949

External Source: FEDORA

Name: FLSA:162680

Type: Advisory

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162680

External Source: MISC

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162391

Type: Advisory

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162391

External Source: UBUNTU

Name: USN-148-1

Type: Advisory

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-148-1

External Source: REDHAT

Name: RHSA-2008:0629

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0629.html

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3298

Hyperlink:http://support.apple.com/kb/HT3298

External Source: SECTRACK

Name: 1014398

Type: Advisory

Hyperlink:http://securitytracker.com/id?1014398

External Source: SECUNIA

Name: 31492

Hyperlink:http://secunia.com/advisories/31492

External Source: APPLE

Name: APPLE-SA-2005-08-15

Hyperlink:http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html

External Source: APPLE

Name: APPLE-SA-2005-08-17

Type: Advisory

Hyperlink:http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html

External Source: APPLE

Name: APPLE-SA-2008-11-13

Hyperlink:http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html

External Source: FREEBSD

Name: FreeBSD-SA-05:16.zlib

Hyperlink:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc

External Source: XF

Name: hpux-secure-shell-dos(24064)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24064

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-9916286-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-9916286-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-3616065-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-3616065-patch.html

External Source: UBUNTU

Name: USN-151-3

Hyperlink:http://www.ubuntulinux.org/usn/usn-151-3

External Source: BUGTRAQ

Name: 20071029 Windows binary of "Virtual Floppy Drive 2.1" contains vulnerable zlib (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482950/100/0/threaded

External Source: BUGTRAQ

Name: 20071029 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482949/100/0/threaded

External Source: BUGTRAQ

Name: 20071021 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482601/100/0/threaded

External Source: BUGTRAQ

Name: 20071020 Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482571/100/0/threaded

External Source: BUGTRAQ

Name: 20071018 Official Windows binaries of "curl" contain vulnerable zlib 1.2.2 (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482505/100/0/threaded

External Source: BUGTRAQ

Name: 20071018 Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482503/100/0/threaded

External Source: BUGTRAQ

Name: 20070404 VMSA-2007-0003 VMware ESX 3.0.1 and 3.0.0 server security updates

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/464745/100/0/threaded

External Source: HP

Name: SSRT051058

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/421411/100/0/threaded

External Source: MANDRIVA

Name: MDKSA-2006:070

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:070

External Source: MANDRIVA

Name: MDKSA-2005:196

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:196

External Source: MANDRAKE

Name: MDKSA-2005:112

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:112

External Source: VUPEN

Name: ADV-2007-1267

Hyperlink:http://www.frsirt.com/english/advisories/2007/1267

External Source: VUPEN

Name: ADV-2006-0144

Hyperlink:http://www.frsirt.com/english/advisories/2006/0144

External Source: DEBIAN

Name: DSA-1026

Hyperlink:http://www.debian.org/security/2006/dsa-1026

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm

External Source: SECUNIA

Name: 24788

Hyperlink:http://secunia.com/advisories/24788

External Source: SECUNIA

Name: 19597

Hyperlink:http://secunia.com/advisories/19597

External Source: SECUNIA

Name: 19550

Hyperlink:http://secunia.com/advisories/19550

External Source: SECUNIA

Name: 18507

Hyperlink:http://secunia.com/advisories/18507

External Source: SECUNIA

Name: 18406

Hyperlink:http://secunia.com/advisories/18406

External Source: SECUNIA

Name: 18377

Hyperlink:http://secunia.com/advisories/18377

External Source: SECUNIA

Name: 17516

Hyperlink:http://secunia.com/advisories/17516

External Source: SECUNIA

Name: 17326

Hyperlink:http://secunia.com/advisories/17326

External Source: SECUNIA

Name: 17236

Hyperlink:http://secunia.com/advisories/17236

External Source: SECUNIA

Name: 17225

Hyperlink:http://secunia.com/advisories/17225

External Source: SECUNIA

Name: 17054

Hyperlink:http://secunia.com/advisories/17054

External Source: MANDRIVA

Name: MDKSA-2006:070

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:070

External Source: MANDRIVA

Name: MDKSA-2005:196

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2005:196

External Source: SCO

Name: SCOSA-2006.6

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6/SCOSA-2006.6.txt

US Government Resource: oval:org.mitre.oval:def:1542

Name: oval:org.mitre.oval:def:1542

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1542

US Government Resource: oval:org.mitre.oval:def:1262

Name: oval:org.mitre.oval:def:1262

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1262