CVE-2010-0001

Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.

Affected Software

Name	Vendor	Start Version	End Version
Gzip	Gnu	*	1.3.13 (including)
Gzip	Gnu	1.2.4 (including)	1.2.4 (including)
Gzip	Gnu	1.2.4a (including)	1.2.4a (including)
Gzip	Gnu	1.3 (including)	1.3 (including)
Gzip	Gnu	1.3.1 (including)	1.3.1 (including)
Gzip	Gnu	1.3.2 (including)	1.3.2 (including)
Gzip	Gnu	1.3.3 (including)	1.3.3 (including)
Gzip	Gnu	1.3.4 (including)	1.3.4 (including)
Gzip	Gnu	1.3.5 (including)	1.3.5 (including)
Gzip	Gnu	1.3.6 (including)	1.3.6 (including)
Gzip	Gnu	1.3.7 (including)	1.3.7 (including)
Gzip	Gnu	1.3.8 (including)	1.3.8 (including)
Gzip	Gnu	1.3.9 (including)	1.3.9 (including)
Gzip	Gnu	1.3.10 (including)	1.3.10 (including)
Gzip	Gnu	1.3.11 (including)	1.3.11 (including)
Gzip	Gnu	1.3.12 (including)	1.3.12 (including)
Red Hat Enterprise Linux 3	RedHat	gzip-0:1.3.3-15.rhel3	*
Red Hat Enterprise Linux 4	RedHat	gzip-0:1.3.3-18.el4_8.1	*
Red Hat Enterprise Linux 5	RedHat	gzip-0:1.3.5-11.el5_4.1	*
Gzip	Ubuntu	dapper	*
Gzip	Ubuntu	hardy	*
Gzip	Ubuntu	intrepid	*
Gzip	Ubuntu	jaunty	*
Gzip	Ubuntu	karmic	*
Gzip	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2010-0001
CWE	https://cwe.mitre.org/data/definitions/189.html

Affected Software

References