CVE-2009-2624

Published: Jan 29, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.

Affected (15)

Products: Gnu: Gzip

1 product

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Gnu Gzip	Up to 1.3.12
Gnu Gzip	Version 1.2.4
Gnu Gzip	Version 1.2.4a
Gnu Gzip	Version 1.3.10
Gnu Gzip	Version 1.3.11
Gnu Gzip	Version 1.3.1
Gnu Gzip	Version 1.3.2
Gnu Gzip	Version 1.3.3
Gnu Gzip	Version 1.3.4
Gnu Gzip	Version 1.3.5
Gnu Gzip	Version 1.3.6
Gnu Gzip	Version 1.3.7
Gnu Gzip	Version 1.3.8
Gnu Gzip	Version 1.3.9
Gnu Gzip	Version 1.3

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://article.gmane.org/gmane.comp.gnu.gzip.bugs/258

Source: cret@cert.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507263

Source: cret@cert.org

http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2

Source: cret@cert.org

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Source: cret@cert.org

http://secunia.com/advisories/38132

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/38223

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/38232

Source: cret@cert.org

Vendor Advisory

http://support.apple.com/kb/HT4435

Source: cret@cert.org

http://www.debian.org/security/2010/dsa-1974

Source: cret@cert.org

http://www.mandriva.com/security/advisories?name=MDVSA-2010:020

Source: cret@cert.org

http://www.ubuntu.com/usn/USN-889-1

Source: cret@cert.org

http://www.vupen.com/english/advisories/2010/0185

Source: cret@cert.org

https://bugzilla.redhat.com/show_bug.cgi?id=514711

Source: cret@cert.org

http://article.gmane.org/gmane.comp.gnu.gzip.bugs/258

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507263

Source: af854a3a-2127-422b-91ae-364da2661108

http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38132

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/38223

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/38232

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://support.apple.com/kb/HT4435

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2010/dsa-1974

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:020

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-889-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0185

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=514711

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.