Lucene search

[email protected]CVE-2009-2624

HistoryJan 29, 2010 - 6:30 p.m.

CVE-2009-2624

2010-01-2918:30:00

CWE-20

[email protected]

web.nvd.nist.gov

huft_build

gzip

denial of service

application crash

infinite loop

arbitrary code

crafted archive

cve-2009-2624

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

9.5

Confidence

High

EPSS

0.155

Percentile

95.9%

JSON

The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.

Affected configurations

NVD

Node

gnugzipRange≤1.3.12

gnugzipMatch1.2.4

gnugzipMatch1.2.4a

gnugzipMatch1.3

gnugzipMatch1.3.1

gnugzipMatch1.3.2

gnugzipMatch1.3.3

gnugzipMatch1.3.4

gnugzipMatch1.3.5

gnugzipMatch1.3.6

gnugzipMatch1.3.7

gnugzipMatch1.3.8

gnugzipMatch1.3.9

gnugzipMatch1.3.10

gnugzipMatch1.3.11

VendorProductVersionCPE
gnugzipcpe:/a:gnu:gzip::::
gnugzip1.3.8cpe:/a:gnu:gzip:1.3.8:::
gnugzip1.3.4cpe:/a:gnu:gzip:1.3.4:::
gnugzip1.3.6cpe:/a:gnu:gzip:1.3.6:::
gnugzip1.3.3cpe:/a:gnu:gzip:1.3.3:::
gnugzip1.2.4acpe:/a:gnu:gzip:1.2.4a:::
gnugzip1.3.11cpe:/a:gnu:gzip:1.3.11:::
gnugzip1.3.1cpe:/a:gnu:gzip:1.3.1:::
gnugzip1.3.9cpe:/a:gnu:gzip:1.3.9:::
gnugzip1.3cpe:/a:gnu:gzip:1.3:::

Vendor	Product	Version	CPE
gnu	gzip		cpe:/a:gnu:gzip::::
gnu	gzip	1.3.8	cpe:/a:gnu:gzip:1.3.8:::
gnu	gzip	1.3.4	cpe:/a:gnu:gzip:1.3.4:::
gnu	gzip	1.3.6	cpe:/a:gnu:gzip:1.3.6:::
gnu	gzip	1.3.3	cpe:/a:gnu:gzip:1.3.3:::
gnu	gzip	1.2.4a	cpe:/a:gnu:gzip:1.2.4a:::
gnu	gzip	1.3.11	cpe:/a:gnu:gzip:1.3.11:::
gnu	gzip	1.3.1	cpe:/a:gnu:gzip:1.3.1:::
gnu	gzip	1.3.9	cpe:/a:gnu:gzip:1.3.9:::
gnu	gzip	1.3	cpe:/a:gnu:gzip:1.3:::