Lucene search

RedhatCVE-2010-0001

HistoryJan 29, 2010 - 6:30 p.m.

CVE-2010-0001

2010-01-2918:30:00

CWE-189

redhat

web.nvd.nist.gov

cve-2010-0001

integer underflow

unlzw.c

gzip

denial of service

remote attackers

arbitrary code

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.9

Confidence

High

EPSS

0.061

Percentile

93.6%

JSON

Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.

Affected configurations

Nvd

Node

gnugzipRange≤1.3.13

gnugzipMatch1.2.4

gnugzipMatch1.2.4a

gnugzipMatch1.3

gnugzipMatch1.3.1

gnugzipMatch1.3.2

gnugzipMatch1.3.3

gnugzipMatch1.3.4

gnugzipMatch1.3.5

gnugzipMatch1.3.6

gnugzipMatch1.3.7

gnugzipMatch1.3.8

gnugzipMatch1.3.9

gnugzipMatch1.3.10

gnugzipMatch1.3.11

gnugzipMatch1.3.12

VendorProductVersionCPE
gnugzip1.3.6cpe:/a:gnu:gzip:1.3.6:::
gnugzip1.3.12cpe:/a:gnu:gzip:1.3.12:::
gnugzip1.3.4cpe:/a:gnu:gzip:1.3.4:::
gnugzip1.3.7cpe:/a:gnu:gzip:1.3.7:::
gnugzip1.3.3cpe:/a:gnu:gzip:1.3.3:::
gnugzip1.2.4cpe:/a:gnu:gzip:1.2.4:::
gnugzip1.2.4acpe:/a:gnu:gzip:1.2.4a:::
gnugzip1.3.5cpe:/a:gnu:gzip:1.3.5:::
gnugzip1.3.9cpe:/a:gnu:gzip:1.3.9:::
gnugzip1.3.10cpe:/a:gnu:gzip:1.3.10:::

Vendor	Product	Version	CPE
gnu	gzip	1.3.6	cpe:/a:gnu:gzip:1.3.6:::
gnu	gzip	1.3.12	cpe:/a:gnu:gzip:1.3.12:::
gnu	gzip	1.3.4	cpe:/a:gnu:gzip:1.3.4:::
gnu	gzip	1.3.7	cpe:/a:gnu:gzip:1.3.7:::
gnu	gzip	1.3.3	cpe:/a:gnu:gzip:1.3.3:::
gnu	gzip	1.2.4	cpe:/a:gnu:gzip:1.2.4:::
gnu	gzip	1.2.4a	cpe:/a:gnu:gzip:1.2.4a:::
gnu	gzip	1.3.5	cpe:/a:gnu:gzip:1.3.5:::
gnu	gzip	1.3.9	cpe:/a:gnu:gzip:1.3.9:::
gnu	gzip	1.3.10	cpe:/a:gnu:gzip:1.3.10:::