zlib vulnerability and modutils

Keith Owens (kaos@ocs.com.au)
Tue, 12 Mar 2002 09:56:20 +1100


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Content-Type: text/plain; charset=us-ascii

A double free vulnerability has been found in zlib which can be used in
a DoS or possibly in an exploit. Distributions are now shipping
upgraded versions of zlib, installing the new version of zlib will fix
programs that use the shared library.

modutils has an option --enable-zlib which lets modprobe and insmod
read modules that have been compressed with gzip. If you built your
modutils with --enable-zlib and are using insmod.static then you must
rebuild modutils after first upgrading zlib. This only applies if
modutils was built with --enable-zlib (the default is not to use zlib)
and you also use static versions of modutils.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: Exmh version 2.1.1 10/15/1999

iD8DBQE8jTYQi4UHNye0ZOoRAnnhAKCrNZ2l8i1JHEVY3fJBnGYrpqAEBgCcDM0q
tPtmhPq2fdJODlfzLlAatmU=
=8r7c
-----END PGP SIGNATURE-----

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/