A vulnerability has been found in zlib that can lead to a heap-based buffer overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | < 1.2.13-r2 | >= 1.2.13-r2 |
zlib is a widely used free and patent unencumbered data compression library.
A vulnerability has been discovered in zlib. Please review the CVE identifier referenced below for details.
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in ZipOpenNewFileInZip4_64 via a long filename, comment, or extra field.
There is no known workaround at this time.
All zlib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.13-r2"
A buffer overflow in zlib might allow an attacker to cause remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | < 1.2.12-r3 | >= 1.2.12-r3 |
zlib is a widely used free and patent unencumbered data compression library.
Multiple vulnerabilities have been discovered in zlib. Please review the CVE identifiers referenced below for details.
Maliciously crafted input handled by zlib may result in remote code execution.
There is no known workaround at this time.
All zlib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.12-r3"
Multiple vulnerabilities have been found in zlib, the worst of which could allow attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | < 1.2.9 | >= 1.2.9 |
zlib is a widely used free and patent unencumbered data compression library.
Multiple vulnerabilities have been discovered in zlib. Please review the CVE identifiers referenced below for details.
An attacker could cause a Denial of Service condition.
There is no known workaround at this time.
All zlib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.9"
zlib is vulnerable to a buffer overflow which could potentially lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | < 1.2.3 | >= 1.2.3 |
zlib is a widely used free and patent unencumbered data compression library.
zlib improperly handles invalid data streams which could lead to a buffer overflow.
By creating a specially crafted compressed data stream, attackers can overwrite data structures for applications that use zlib, resulting in arbitrary code execution or a Denial of Service.
There is no known workaround at this time.
All zlib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.3"
A buffer overflow has been discovered in zlib, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | < 1.2.2-r1 | >= 1.2.2-r1 |
zlib is a widely used free and patent unencumbered data compression library.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a buffer overflow in zlib. A bounds checking operation failed to take invalid data into account, allowing a specifically malformed deflate data stream to overrun a buffer.
An attacker could construct a malformed data stream, embedding it within network communication or an application file format, potentially resulting in the execution of arbitrary code when decoded by the application using the zlib library.
There is no known workaround at this time.
All zlib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.2-r1"
The zlib library contains a Denial of Service vulnerability.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-libs/zlib | * | <= 1.2.1-r2 | >= 1.2.1-r3 |
zlib is a general-purpose data-compression library.
zlib contains a bug in the handling of errors in the "inflate()" and "inflateBack()" functions.
An attacker could exploit this vulnerability to launch a Denial of Service attack on any application using the zlib library.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of zlib.
All zlib users should upgrade to the latest version:
# emerge sync # emerge -pv ">=sys-libs/zlib-1.2.1-r3" # emerge ">=sys-libs/zlib-1.2.1-r3"
You should also run revdep-rebuild to rebuild any packages that depend on older versions of zlib :
# revdep-rebuild