Debian: 2074-1: ncompress: integer underflow

LinuxSecurity.com: An integer underflow vulnerability has been fixed which can be used by malicious people to cause denial of service.

Referenced CVEs: 

CVE-2009-2624, CVE-2010-0001

Description: 

===========================================================
Ubuntu Security Notice USN-889-1 January 20, 2010
gzip vulnerabilities
CVE-2009-2624, CVE-2010-0001
===================================================

LinuxSecurity.com: Multiple integer overflows have been fixed in tiff which can be used by malicious people to execute arbitrary code.

In this article, it is intended to discuss the following utilities that are used to compress and uncompress files in Linux:

• tar
• gzip & gunzip
• bzip2 & bunzip2

tar

LinuxSecurity.com: Martin Barbella discovered an integer overflow in an XSLT node sortingroutine. An attacker could exploit this to overflow a buffer and cause adenial of service or possibly execute arbitrary code with the privileges ofthe user invoking the program. (CVE-2010-1199) [More...]

LinuxSecurity.com: It was discovered that OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft(R) Office, is not properly handling python macros embedded in an office document. This allows an attacker to perform user-assisted execution of arbitrary code in [More...]

LinuxSecurity.com: It was discovered that the JasPer JPEG-2000 runtime library allowed an attacker to create a crafted input file that could lead to denial of service and heap corruption. [More...]

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that the Compress::Raw::Zlib Perl module incorrectly
handled certain zlib compressed streams. If a user or automated system were
tricked into processing a specially crafted compressed stream or file, a
remote attacker could crash the application, leading to a denial of

LinuxSecurity.com: Multiple vulnerabilities was discovered and fixed in glibc:
Multiple integer overflows in the strfmon implementation in
the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow
context-dependent attackers to cause a denial of service (memory
[More...]