CVE-2010-0001

gzip: (64 bit) Integer underflow by decompressing LZW format files

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.

Desbordamiento de entero en la función unlzw en unlzw.c en gzip anterior a v1.4 sobre las plataformas de 64 bits, permiten a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de un archivo manipulado que emplea la compresión LZW, permitiendo a un array indexar el error.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-12-14 CVE Reserved
2010-01-20 CVE Published
2023-03-07 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-189: Numeric Errors
CWE-190: Integer Overflow or Wraparound

CAPEC

References (32)

URL	Tag	Source
http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=a3db5806d012082b9e25cc36d09f19cd736a468f	X_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705	X_refsource_confirm
http://ncompress.sourceforge.net/#status	X_refsource_confirm
http://savannah.gnu.org/forum/forum.php?forum_id=6153	X_refsource_confirm
http://secunia.com/advisories/40551	Third Party Advisory
http://secunia.com/advisories/40655	Third Party Advisory
http://secunia.com/advisories/40689	Third Party Advisory
http://securitytracker.com/id?1023490	Vdb Entry
http://support.apple.com/kb/HT4435	X_refsource_confirm
http://www.osvdb.org/61869	Vdb Entry
http://www.vupen.com/english/advisories/2010/1796	Vdb Entry
http://www.vupen.com/english/advisories/2010/1872	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10546	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7511	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083	2023-02-13
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	2023-02-13
http://secunia.com/advisories/38220	2023-02-13
http://secunia.com/advisories/38223	2023-02-13
http://secunia.com/advisories/38225	2023-02-13
http://secunia.com/advisories/38232	2023-02-13
http://www.debian.org/security/2010/dsa-1974	2023-02-13
http://www.debian.org/security/2010/dsa-2074	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:019	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:020	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2011:152	2023-02-13
http://www.redhat.com/support/errata/RHSA-2010-0061.html	2023-02-13
http://www.ubuntu.com/usn/USN-889-1	2023-02-13
http://www.vupen.com/english/advisories/2010/0185	2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=554418	2010-01-20
https://rhn.redhat.com/errata/RHSA-2010-0095.html	2023-02-13
https://access.redhat.com/security/cve/CVE-2010-0001	2010-01-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				<= 1.3.13 Search vendor "Gnu" for product "Gzip" and version " <= 1.3.13"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.2.4 Search vendor "Gnu" for product "Gzip" and version "1.2.4"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.2.4a Search vendor "Gnu" for product "Gzip" and version "1.2.4a"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3 Search vendor "Gnu" for product "Gzip" and version "1.3"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.1 Search vendor "Gnu" for product "Gzip" and version "1.3.1"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.2 Search vendor "Gnu" for product "Gzip" and version "1.3.2"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.3 Search vendor "Gnu" for product "Gzip" and version "1.3.3"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.4 Search vendor "Gnu" for product "Gzip" and version "1.3.4"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.5 Search vendor "Gnu" for product "Gzip" and version "1.3.5"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.6 Search vendor "Gnu" for product "Gzip" and version "1.3.6"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.7 Search vendor "Gnu" for product "Gzip" and version "1.3.7"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.8 Search vendor "Gnu" for product "Gzip" and version "1.3.8"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.9 Search vendor "Gnu" for product "Gzip" and version "1.3.9"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.10 Search vendor "Gnu" for product "Gzip" and version "1.3.10"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.11 Search vendor "Gnu" for product "Gzip" and version "1.3.11"		-		Affected
Gnu Search vendor "Gnu"		Gzip Search vendor "Gnu" for product "Gzip"				1.3.12 Search vendor "Gnu" for product "Gzip" and version "1.3.12"		-		Affected