Executive Summary

Title New zlib & other packages fix buffer overflow
Name DSA-122 First vendor Publication 2002-03-11
Vendor Debian Last vendor Modification 2002-03-11
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


The compression library zlib has a flaw in which it attempts to free memory more than once under certain conditions. This can possibly be exploited to run arbitrary code in a program that includes zlib. If a network application running as root is linked to zlib, this could potentially lead to a remote root compromise. No exploits are known at this time. This vulnerability is assigned the CVE candidate name of CAN-2002-0059.

The zlib vulnerability is fixed in the Debian zlib package version 1.1.3-5.1. A number of programs either link statically to zlib or include a private copy of zlib code. These programs must also be upgraded to eliminate the zlib vulnerability. The affected packages and fixed versions follow: amaya 2.4-1potato1 dictd 1.4.9-9potato1 erlang 49.1-10.1 freeamp 2.0.6-2.1 mirrordir 0.10.48-2.1 ppp 2.3.11-1.5 rsync 2.3.2-1.6 vrweb 1.5-5.1

Those using the pre-release (testing) version of Debian should upgrade to zlib 1.1.3-19.1 or a later version. Note that since this version of Debian has not yet been released it may not be available immediately for all architectures. Debian 2.2 (potato) is the latest supported release.

We recommend that you upgrade your packages immediately. Note that you should restart all programs that use the shared zlib library in order for the fix to take effect. This is most easily done by rebooting the system.

wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 2.2 alias potato

Original Source

Url : http://www.debian.org/security/2002/dsa-122

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-415 Double Free

CPE : Common Platform Enumeration

Application 16

OpenVAS Exploits

Date Description
2008-01-17 Name : Debian Security Advisory DSA 122-1 (zlib, various)
File : nvt/deb_122_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
2052 zlib Compression Library Heap Corruption

Nessus® Vulnerability Scanner

Date Description
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-122.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2002-022.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2002-023.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing a security update.
File : mandrake_MDKSA-2002-024.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2014-02-17 11:26:21
  • Multiple Updates