CVE-2006-4338

Description

unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 6.39% Top 10%

Vendor Advisory gentoo.org Vendor Advisory novell.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory securityfocus.com Vendor Advisory freebsd.org Vendor Advisory openpkg.org Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory securityfocus.com Vendor Advisory trustix.org Vendor Advisory sun.com Vendor Advisory securityfocus.com Vendor Advisory apple.com Vendor Advisory sgi.com Vendor Advisory slackware.com Vendor Advisory debian.org Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.vupen.com/english/advisories/2006/4760	vdb entry
http://www.vupen.com/english/advisories/2006/4750	vdb entry
http://secunia.com/advisories/23679	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-200611-24.xml	vendor advisory
http://secunia.com/advisories/24435	third party advisory
http://secunia.com/advisories/22085	third party advisory
http://secunia.com/advisories/22043	third party advisory patch vendor advisory
http://www.novell.com/linux/security/advisories/2006_56_gzip.html	vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2006-218.htm
http://secunia.com/advisories/22487	third party advisory
https://issues.rpath.com/browse/RPL-615
http://secunia.com/advisories/22033	third party advisory patch vendor advisory
http://secunia.com/advisories/22002	third party advisory patch vendor advisory
http://www.vupen.com/english/advisories/2006/3695	vdb entry
http://docs.info.apple.com/article.html?artnum=304829
http://secunia.com/advisories/21996	third party advisory
http://secunia.com/advisories/23153	third party advisory
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676
http://secunia.com/advisories/22009	third party advisory patch vendor advisory
http://secunia.com/advisories/22017	third party advisory patch vendor advisory
http://www.vupen.com/english/advisories/2007/0092	vdb entry
http://www.redhat.com/support/errata/RHSA-2006-0667.html	vendor advisory
http://www.vupen.com/english/advisories/2007/1171	vdb entry
http://security.gentoo.org/glsa/glsa-200609-13.xml	vendor advisory
http://www.securityfocus.com/archive/1/451324/100/0/threaded	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11290	vdb entry signature
http://security.freebsd.org/advisories/FreeBSD-SA-06:21.gzip.asc	vendor advisory
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.020-gzip.html	vendor advisory
http://www.ubuntu.com/usn/usn-349-1	vendor advisory
http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/29046	vdb entry
http://secunia.com/advisories/22435	third party advisory
http://secunia.com/advisories/23156	third party advisory
http://www.securityfocus.com/archive/1/464268/100/0/threaded	mailing list
http://secunia.com/advisories/22027	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:167	vendor advisory
http://secunia.com/advisories/23155	third party advisory
http://www.securityfocus.com/archive/1/462007/100/0/threaded	vendor advisory
http://www.securityfocus.com/bid/20101	vdb entry
http://www.trustix.org/errata/2006/0052/	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102766-1	vendor advisory
http://www.securityfocus.com/archive/1/450078/100/0/threaded	vendor advisory
http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html	vendor advisory
http://www.us-cert.gov/cas/techalerts/TA06-333A.html	third party advisory us government resource
http://www.securityfocus.com/archive/1/446426/100/0/threaded	mailing list
http://secunia.com/advisories/24636	third party advisory
http://secunia.com/advisories/22012	third party advisory patch vendor advisory
ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc	vendor advisory
http://securitytracker.com/id?1016883	vdb entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852	patch vendor advisory
http://www.osvdb.org/29008	vdb entry
http://secunia.com/advisories/22034	third party advisory patch vendor advisory
http://secunia.com/advisories/22101	third party advisory
http://www.us.debian.org/security/2006/dsa-1181	vendor advisory
http://www.vupen.com/english/advisories/2007/0832	vdb entry
http://secunia.com/advisories/22661	third party advisory
http://www.vupen.com/english/advisories/2006/4275	vdb entry

Frequently Asked Questions

What is the severity of CVE-2006-4338?: CVE-2006-4338 has been scored as a medium severity vulnerability.
How to fix CVE-2006-4338?: To fix CVE-2006-4338, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-4338 being actively exploited in the wild?: It is possible that CVE-2006-4338 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~6% probability that this vulnerability will be exploited by malicious actors in the next 30 days.