| Description: | Description:
The remote host is missing updates announced in
advisory FLSA-2005:162680.
Tavis Ormandy discovered a buffer overflow affecting Zlib version 1.2
and above. An attacker could create a carefully crafted compressed
stream that would cause an application to crash if the stream is opened
by a user. As an example, an attacker could create a malicious PNG image
file which would cause a web browser or mail viewer to crash if the
image is viewed. The Common Vulnerabilities and Exposures project
assigned the name CVE-2005-2096 to this issue.
Markus Oberhumer discovered additional ways a stream could trigger an
overflow. An attacker could create a carefully crafted compressed stream
that would cause an application to crash if the stream is opened by a
user. As an example, an attacker could create a malicious PNG image file
that would cause a Web browser or mail viewer to crash if the image is
viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the name CVE-2005-1849 to this issue.
All users should update to these erratum packages which contain a patch
from Mark Adler which corrects this issue.
Affected platforms:
Fedora Core 1
Fedora Core 2
Solution:
http://www.securityspace.com/smysecure/catid.html?in=FLSA-2005:162680
Risk factor : High
CVSS Score:
7.5
|
