CVE-2009-2624

CVE	CVE-2009-2624
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2010-01-29 18:30:00 UTC
Updated	2010-11-18 06:29:00 UTC
Description	The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.

Problem Types: CWE-20

Type	Vendor	Product	Version	Update	Edition	Language
Application	Gnu	Gzip	1.2.4	All	All	All
Application	Gnu	Gzip	1.2.4a	All	All	All
Application	Gnu	Gzip	1.3	All	All	All
Application	Gnu	Gzip	1.3.1	All	All	All
Application	Gnu	Gzip	1.3.10	All	All	All
Application	Gnu	Gzip	1.3.11	All	All	All
Application	Gnu	Gzip	1.3.2	All	All	All
Application	Gnu	Gzip	1.3.3	All	All	All
Application	Gnu	Gzip	1.3.4	All	All	All
Application	Gnu	Gzip	1.3.5	All	All	All
Application	Gnu	Gzip	1.3.6	All	All	All
Application	Gnu	Gzip	1.3.7	All	All	All
Application	Gnu	Gzip	1.3.8	All	All	All
Application	Gnu	Gzip	1.3.9	All	All	All
Application	Gnu	Gzip	1.2.4	All	All	All
Application	Gnu	Gzip	1.2.4a	All	All	All
Application	Gnu	Gzip	1.3	All	All	All
Application	Gnu	Gzip	1.3.1	All	All	All
Application	Gnu	Gzip	1.3.10	All	All	All
Application	Gnu	Gzip	1.3.11	All	All	All
Application	Gnu	Gzip	1.3.2	All	All	All
Application	Gnu	Gzip	1.3.3	All	All	All
Application	Gnu	Gzip	1.3.4	All	All	All
Application	Gnu	Gzip	1.3.5	All	All	All
Application	Gnu	Gzip	1.3.6	All	All	All
Application	Gnu	Gzip	1.3.7	All	All	All
Application	Gnu	Gzip	1.3.8	All	All	All
Application	Gnu	Gzip	1.3.9	All	All	All
Application	Gnu	Gzip	All	All	All	All

Reference	Source	Link	Tags
Advisories \| Mandriva	MANDRIVA	www.mandriva.com
APPLE-SA-2010-11-10-1 Mac OS X v10.6.5 and Security Update 2010-007	APPLE	lists.apple.com
Debian -- Security Information -- DSA-1974-1 gzip	DEBIAN	www.debian.org
Ubuntu update for gzip - Advisories - Community	SECUNIA	secunia.com	Vendor Advisory
USN-889-1: gzip vulnerabilities \| Ubuntu	UBUNTU	www.ubuntu.com
[security-announce] SUSE Security Announcement: acoread (SUSE-SA:2010:00	SUSE	lists.opensuse.org
GNU gzip "huft_build()" Input Sanitation Vulnerability - Advisories - Community	SECUNIA	secunia.com	Vendor Advisory
Debian update for gzip - Advisories - Community	SECUNIA	secunia.com	Vendor Advisory
#507263 - gzip: segfaults on deflate of malformed input file - Debian Bug report logs	CONFIRM	bugs.debian.org
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	VUPEN	www.vupen.com
gzip.git - Unnamed repository; edit this file 'description' to name the repository.	CONFIRM	git.savannah.gnu.org
Bug 514711 – CVE-2009-2624 gzip: Missing input sanitation by decompressing dynamic Huffman code blocks	CONFIRM	bugzilla.redhat.com
About the security content of Mac OS X v10.6.5 and Security Update 2010-007	CONFIRM	support.apple.com
Gmane -- gzip 1.3.13 released major	MLIST	article.gmane.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2010-02-02	Tomas Hoger	Not vulnerable. This issue did not affect the versions of gzip as shipped with Red Hat Enterprise Linux 3, 4, or 5.

There are currently no legacy QID mappings associated with this CVE.