258009 - DoS vulnerability in zlib-1.2.1

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Glenn Randers-Pehrson]

A newly disclosed DoS vulnerability is reported to exist in zlib-1.2.1.
It has been published openly at the openpkg URL mentioned above.

A simple patch is available.  I'm not sure whether the patch has been made
public.  For now I'm marking the bug as a "security problem".

Comment 1

[Glenn Randers-Pehrson]

Attachment: Patch from CERT

zlib patch as received from CERT.  Needs to be converted to a mozilla patch.

Comment 2

[Glenn Randers-Pehrson]

Reducing severity to normal because zlib-1.2.1 hasn't landed yet.  Marking
as blocking bug #248644.  If someone uses the system lib they might be vulnerable.
This issue has been assigned CVE# CAN-2004-0797 and CERT VU #238678.

Comment 3

[Glenn Randers-Pehrson]

Oops, 1.2.1 did land recently, see bug #226733

The zlib developers are planning to release version 1.2.2 soon with the
vulnerability fixed.

Comment 4

[Glenn Randers-Pehrson]

Attachment: Patch for zlib-1.2.1 in Mozilla trunk

Patch updated to mozilla style; also updates ChangelogMoz, does not update
irrelevant contrib file.

Comment 5

[Glenn Randers-Pehrson]

Comment on attachment 157886 [details] [diff] [review]
Patch for zlib-1.2.1 in Mozilla trunk

tor: r?

Comment 6

[Hixie (not reading bugmail)]

(opening bug since it is already public)

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 157886 [details] [diff] [review]
Patch for zlib-1.2.1 in Mozilla trunk

sr=dveditz
a=dveditz for 1.7 branch

Comment 8

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 157886 [details] [diff] [review]
Patch for zlib-1.2.1 in Mozilla trunk

a=[e-mail]

Comment 9

[Daniel Veditz [:dveditz]]

Clearing 1.7 and aviary blocking flags. Those branches do not have 1.2.1,
they're still using 1.1.4

Comment 10

[tor]

Checked in on trunk.

Comment 11

[Glenn Randers-Pehrson]

zlib 1.2.2 has been released.  See bug #248644.