CVE-2005-2096

NameCVE-2005-2096
Descriptionzlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1026-1, DSA-740-1, DSA-797-1, DSA-797-2
Debian Bugs309196, 317133, 317523, 317966, 317967, 317968, 317970, 317971, 318014, 318069, 318091, 318097, 318099, 318100, 318246, 319858, 332236

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
aide (PTS)buster, buster (security)0.16.1-1+deb10u1fixed
bullseye (security), bullseye0.17.3-4+deb11u1fixed
bookworm, sid0.17.4-2fixed
bacula (PTS)buster9.4.2-2+deb10u1fixed
bullseye9.6.7-3fixed
bookworm, sid9.6.7-5fixed
dar (PTS)buster2.6.2-1fixed
bullseye2.6.13-2fixed
bookworm, sid2.7.7-1fixed
dpkg (PTS)buster, buster (security)1.19.8fixed
bullseye1.20.12fixed
bullseye (security)1.20.10fixed
bookworm, sid1.21.9fixed
dump (PTS)buster0.4b46-5fixed
bullseye0.4b46-8fixed
bookworm, sid0.4b47-4fixed
libphysfs (PTS)buster3.0.1-3.1fixed
bullseye3.0.2-5fixed
bookworm, sid3.0.2-6fixed
mrtg (PTS)buster2.17.7-1fixed
bullseye2.17.7-2+deb11u1fixed
bookworm, sid2.17.10-4fixed
pvpgn (PTS)buster/contrib, bullseye/contrib1.8.5-2.1fixed
bookworm/contrib, sid/contrib1.8.5-3fixed
rpm (PTS)buster4.14.2.1+dfsg1-1fixed
bullseye4.16.1.2+dfsg1-3fixed
bookworm, sid4.17.1.1+dfsg-1fixed
rsync (PTS)buster3.1.3-6fixed
bullseye3.2.3-4+deb11u1fixed
bookworm, sid3.2.6-4fixed
sash (PTS)bookworm, sid, buster, bullseye3.8-5fixed
zlib (PTS)buster1:1.2.11.dfsg-1+deb10u1fixed
buster (security)1:1.2.11.dfsg-1+deb10u2fixed
bullseye (security), bullseye1:1.2.11.dfsg-2+deb11u2fixed
bookworm, sid1:1.2.11.dfsg-4.1fixed
zsync (PTS)buster, bullseye0.6.2-3fixed
bookworm, sid0.6.2-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
aidesourcewoody(not affected)
aidesource(unstable)0.10-6.1.1unimportant317523
amd64-libssourcewoody(not affected)
amd64-libssource(unstable)1.3medium317970
baculasourcewoody(not affected)
baculasource(unstable)1.36.3-2medium318014
darsource(unstable)(not affected)
dpkgsourcewoody(not affected)
dpkgsource(unstable)1.13.11unimportant317967
dumpsourcewoody(not affected)
dumpsource(unstable)0.4b40-1low317966
ia32-libssourcewoody(not affected)
ia32-libssource(unstable)1.6medium317971
libphysfssourcewoody(not affected)
libphysfssource(unstable)1.0.0-5unimportant318091
mrtgsource(unstable)(not affected)
mysql-dfsg-4.1source(unstable)4.1.13-1unimportant319858
oopssource(unstable)1.5.23.cvs-3medium318097
pvpgnsource(unstable)1.7.8-2332236
rageircdsource(unstable)2.0.0-3sid1medium309196
rpmsourcewoody(not affected)
rpmsource(unstable)4.0.4-31.1unimportant318099
rsyncsource(unstable)(not affected)
sashsourcewoody(not affected)
sashsourcesarge3.7-5sarge1DSA-1026-1
sashsource(unstable)3.7-6medium318069, 318246
systemimager-sshsource(unstable)(not affected)
texmacssourcewoody(not affected)
texmacssource(unstable)1:1.0.5-3medium318100
zlibsourcewoody(not affected)DSA-740-1
zlibsourcesarge1:1.2.2-4.sarge.1mediumDSA-740-1
zlibsource(unstable)1:1.2.2-7medium317133
zsyncsourcesarge0.3.3-1.sarge.1mediumDSA-797-1
zsyncsource(unstable)0.4.0-2medium317968

Notes

Several packages ship embedded copies of zlib, there are a lot probably more
Florian Weimer is doing a comprehensive audit using clamav
to search for static zlib signatures in binaries in Debian
Not all of the listed packages have been checked for actual
exploitability using this hole.
oldstable (woody) had zlib 1.1, which is not affected
[woody] - dpkg <not-affected> (Woody contains zlib 1.1, which is not affected)
You need to trust debs anyway, when installing them
[woody] - dump <not-affected> (Woody contains zlib 1.1, which is not affected)
[sarge] - dump <no-dsa> (Backups do not contain untrusted data)
[woody] - aide <not-affected> (Woody contains zlib 1.1, which is not affected)
aide only uses zlib to compress/decompress internal data
[woody] - amd64-libs <not-affected> (Woody contains zlib 1.1, which is not affected)
[woody] - ia32-libs <not-affected> (Woody contains zlib 1.1, which is not affected)
- dar <not-affected> (zlib not used on unstrusted input, see #317989)
[woody] - bacula <not-affected> (Woody contains zlib 1.1, which is not affected)
[sarge] - bacula <no-dsa> (Backups do not contain untrusted data)
[woody] - sash <not-affected> (Woody contains zlib 1.1, which is not affected)
[woody] - libphysfs <not-affected> (Woody contains zlib 1.1, which is not affected)
[woody] - rpm <not-affected> (Woody contains zlib 1.1, which is not affected)
You need to trust rpms anyway, when installing them
- systemimager-ssh <not-affected> (bug #318101; unimportant)
see dannf's first bug comment; systemimager-ssh doesn't use compression
[woody] - texmacs <not-affected> (Woody contains zlib 1.1, which is not affected)
[sarge] - texmacs <no-dsa> (Hardly exploitable)
- mrtg <not-affected> (Only used for internal compression, current versions link dynamically)
- rsync <not-affected> (Uses zlib 1.1, which is not affected)
rsync upstream updated the internal zlib copy in 2.6.6 without real need,
as the included version was never affected, despite claiming them so.

Search for package or bug name: Reporting problems