• New (old) ZLIB patch for old vulnerability

    From Big Bad Bombastic Bob@21:1/5 to All on Fri Apr 1 02:18:37 2022
    https://www.theregister.com/2022/03/30/zlib_data_bug/

    "The widely used Zlib data-compression library finally has a patch to
    close a vulnerability that could be exploited to crash applications and services — four years after the vulnerability was first discovered but effectively left unfixed."

    "In short, this is a memory-corruption flaw: software that relies on
    zlib to compress user-supplied data can be made to crash and terminate,
    through an out-of-bounds write, if that data is specially formatted.
    Depending on how this user-controlled information is used, some backup operations and logging could unexpectedly stop, for instance. Document
    viewers and editors could fail to open files, and browser windows or
    tabs could bomb out."

    "It is rated 7.5 out of 10 in terms of CVSS severity, or simply: high severity."

    I'd start by first disabling gzipped content being sent to web servers
    and so on, then go from there.

    and keep an eye on ZIP content attached to e-mails...

    --
    (aka 'Bombastic Bob' in case you wondered)

    'Feeling with my fingers, and thinking with my brain' - me

    'your story is so touching, but it sounds just like a lie'
    "Straighten up and fly right"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)