what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2011-153

Posted Oct 17, 2011

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-153 - The LZW decompressor in the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to and CVE-2011-2896. The updated packages have been patched to correct this issue.

tags | advisory, overflow, arbitrary

systems | linux, netbsd, freebsd, openbsd, mandriva

advisories | CVE-2011-2895

SHA-256 | 74b02a4d1cc9f234803f357f47342c8c7e438ae30758ff5024405fab894f950a

Download | Favorite | View

Related Files

No related files