blob: f64cdbb19d88df8ca79da17e3326603303dc7c07 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200610-03">
<title>ncompress: Buffer Underflow</title>
A buffer underflow vulnerability has been reported in ncompress allowing
for the execution of arbitrary code.
<product type="ebuild">ncompress</product>
<announced>October 06, 2006</announced>
<revised>October 06, 2006: 01</revised>
<package name="app-arch/ncompress" auto="yes" arch="*">
<unaffected range="ge"></unaffected>
<vulnerable range="lt"></vulnerable>
ncompress is a suite of utilities to create and extract
Lempel-Ziff-Welch (LZW) compressed archives.
Tavis Ormandy of the Google Security Team discovered a static buffer
underflow in ncompress.
<impact type="normal">
An attacker could create a specially crafted LZW archive, that when
decompressed by a user or automated system would result in the
execution of arbitrary code with the permissions of the user invoking
the utility.
There is no known workaround at this time.
All ncompress users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-arch/ncompress-;</code>
<uri link="">CVE-2006-1168</uri>
<metadata tag="requester" timestamp="Fri, 29 Sep 2006 14:20:45 +0000">
<metadata tag="submitter" timestamp="Mon, 02 Oct 2006 10:06:04 +0000">
<metadata tag="bugReady" timestamp="Fri, 06 Oct 2006 17:50:24 +0000">