touch-packages team mailing list archive

[Cs-gon <1358762@xxxxxxxxxxxxxxxxxx>]

Will this security vulnerability get fixed at all? I realize that the
impact is pretty small, because someone would have to explicitly use the
gzip binary provided with klibc. But even the new klibc package in
trusty/utopic/vivid still contains the old 1.2.4 version of gzip.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to klibc in Ubuntu.
https://bugs.launchpad.net/bugs/1358762

Title:
  Included gzip 1.2.4 has several vulnerabilities

Status in “klibc” package in Ubuntu:
  Confirmed

Bug description:
  The included gzip version is quite old (version 1.2.4) and has several
  security vulnerabilities.

  Check http://web.nvd.nist.gov/view/vuln/search-
  results?adv_search=true&cves=on&cpe_version=cpe:/a:gnu:gzip:1.2.4 for
  example.

  I explicitly checked for CVE-2001-1228, which was not fixed by a patch
  in the klibc package, so I assume the other vulnerabilities are not
  fixed either.

  I think it would be a good idea to update the included gzip to a
  current version.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/klibc/+bug/1358762/+subscriptions