Navigation
|
|
| Problem Description |
Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which
allows local users to execute arbitrary commands via filenames that are
injected into a sed script.
This was previously corrected in MDKSA-2005:092, however the fix was
incomplete. These updated packages provide a more comprehensive fix
to the problem.
| Updated Packages |
Mandrakelinux 10.1
62937bbc65984b8f32a8817ca9d0a83a 10.1/RPMS/gzip-1.2.4a-13.3.101mdk.i586.rpm 03b66c3fff9a34edf0f714f773755d94 10.1/SRPMS/gzip-1.2.4a-13.3.101mdk.src.rpm
Mandrakelinux 10.1/X86_64
fc3cc9dbcf1ca6b67f19a512ca555ed9 x86_64/10.1/RPMS/gzip-1.2.4a-13.3.101mdk.x86_64.rpm 03b66c3fff9a34edf0f714f773755d94 x86_64/10.1/SRPMS/gzip-1.2.4a-13.3.101mdk.src.rpm
Corporate Server 2.1
3b8cb2a9448fc5411bd8e49bb7037ffe corporate/2.1/RPMS/gzip-1.2.4a-11.5.C21mdk.i586.rpm 3baf958e1a8159e1621f7d1694b24a24 corporate/2.1/SRPMS/gzip-1.2.4a-11.5.C21mdk.src.rpm
Corporate Server 2.1/X86_64
996b5e2b2b3f330fa9387e18e9f7d422 x86_64/corporate/2.1/RPMS/gzip-1.2.4a-11.5.C21mdk.x86_64.rpm 3baf958e1a8159e1621f7d1694b24a24 x86_64/corporate/2.1/SRPMS/gzip-1.2.4a-11.5.C21mdk.src.rpm
Corporate Server 3.0
8d5bbe00592a9830ce4ac5d2b120e867 corporate/3.0/RPMS/gzip-1.2.4a-13.3.C30mdk.i586.rpm 5baa56e8feb905c9fb48629344a88b02 corporate/3.0/SRPMS/gzip-1.2.4a-13.3.C30mdk.src.rpm
Corporate Server 3.0/X86_64
0fd942e8d92942d5cee224263a27db9c x86_64/corporate/3.0/RPMS/gzip-1.2.4a-13.3.C30mdk.x86_64.rpm 5baa56e8feb905c9fb48629344a88b02 x86_64/corporate/3.0/SRPMS/gzip-1.2.4a-13.3.C30mdk.src.rpm
Multi Network Firewall 2.0
1c2352fc2445c452769181be3d4e85a1 mnf/2.0/RPMS/gzip-1.2.4a-13.3.M20mdk.i586.rpm 601229e6188ad8ee34ff12f1147c5381 mnf/2.0/SRPMS/gzip-1.2.4a-13.3.M20mdk.src.rpm
Mandriva Linux LE2005
431066b4062f9f23a09a137edb20b7b6 10.2/RPMS/gzip-1.2.4a-14.2.102mdk.i586.rpm 15e833f4126a3708773a7f055c24e21e 10.2/SRPMS/gzip-1.2.4a-14.2.102mdk.src.rpm
Mandriva Linux LE2005/X86_64
b18f7f611c82083e8e5605687165f1f3 x86_64/10.2/RPMS/gzip-1.2.4a-14.2.102mdk.x86_64.rpm 15e833f4126a3708773a7f055c24e21e x86_64/10.2/SRPMS/gzip-1.2.4a-14.2.102mdk.src.rpm
Mandriva Linux 2006
9a496bbbe2e1a07096c7ac536fc2456c 2006.0/RPMS/gzip-1.2.4a-15.1.20060mdk.i586.rpm da6e6cd98d8e37904c6e5140950367ac 2006.0/SRPMS/gzip-1.2.4a-15.1.20060mdk.src.rpm
Mandriva Linux 2006/X86_64
e1e5bf8168bdd95291364b4078504df5 x86_64/2006.0/RPMS/gzip-1.2.4a-15.1.20060mdk.x86_64.rpm da6e6cd98d8e37904c6e5140950367ac x86_64/2006.0/SRPMS/gzip-1.2.4a-15.1.20060mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0758
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.