[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <8r03095n-p8q4-srpr-431q-593ror3sss45@unkk.fr>
Date: Thu, 6 Feb 2025 09:33:00 +0100 (CET)
From: Daniel Stenberg <daniel@...x.se>
To: Fay Stegerman <flx@...usk.net>
cc: oss-security@...ts.openwall.com
Subject: Re: [SECURITY ADVISORY] curl: CVE-2025-0725: gzip
integer overflow
On Wed, 5 Feb 2025, Fay Stegerman wrote:
>> libcurl featured code that at run-time takes a different code path for zlib
>> versions before 1.0.2.4 because of lack of functionality in those old
>> versions, and this rarely used piece of code contained the vulnerable code
>> path.
>
> I assume this last version should have been 1.2.0.4 as before and not
> 1.0.2.4?
Correct, this has been fixed already in the document version we host.
> Which, whilst I doubt we'll see such a zlib version any time soon if ever
> (though zlib-ng compat might get there a lot faster), would give an
> incorrect result for e.g. version "1.10.0.0".
Thanks for pointing this out. I have proposed fix pending:
https://github.com/curl/curl/pull/16202
--
/ daniel.haxx.se
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
