요약

Important: bzip2 security update

유형/심각도

Security Advisory: Important

주제

Updated bzip2 packages that fix one security issue are now available for
Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

설명

bzip2 is a freely available, high-quality data compressor. It provides both
standalone compression and decompression utilities, as well as a shared
library for use with other programs.

An integer overflow flaw was discovered in the bzip2 decompression routine.
This issue could, when decompressing malformed archives, cause bzip2, or an
application linked against the libbz2 library, to crash or, potentially,
execute arbitrary code. (CVE-2010-0405)

Users of bzip2 should upgrade to these updated packages, which contain a
backported patch to resolve this issue. All running applications using the
libbz2 library must be restarted for the update to take effect.

솔루션

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

영향을 받는 제품

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

수정

• BZ - 627882 - CVE-2010-0405 bzip2: integer overflow flaw in BZ2_decompress

CVE

• CVE-2010-0405

참조

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
x86_64
bzip2-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 129dfc44e8ed2bb807c637bbaeac1f72f185358b08307425d72fd53769fe80a8
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-devel-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 5a326aafe81efdf54ffbb82482cf39f9a2f35457077d315b0eac96e2057d4af0
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f
bzip2-libs-1.0.3-6.el5_5.x86_64.rpm	SHA-256: e4f95d0eb43db6e489c53a0ff46684271741d9e5c9db4c3b185cb99ae2bfe01c
ia64
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f
i386
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
bzip2-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 129dfc44e8ed2bb807c637bbaeac1f72f185358b08307425d72fd53769fe80a8
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-devel-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 5a326aafe81efdf54ffbb82482cf39f9a2f35457077d315b0eac96e2057d4af0
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f
bzip2-libs-1.0.3-6.el5_5.x86_64.rpm	SHA-256: e4f95d0eb43db6e489c53a0ff46684271741d9e5c9db4c3b185cb99ae2bfe01c
i386
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
bzip2-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 129dfc44e8ed2bb807c637bbaeac1f72f185358b08307425d72fd53769fe80a8
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f
bzip2-libs-1.0.3-6.el5_5.x86_64.rpm	SHA-256: e4f95d0eb43db6e489c53a0ff46684271741d9e5c9db4c3b185cb99ae2bfe01c
i386
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
bzip2-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 129dfc44e8ed2bb807c637bbaeac1f72f185358b08307425d72fd53769fe80a8
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-devel-1.0.3-6.el5_5.x86_64.rpm	SHA-256: 5a326aafe81efdf54ffbb82482cf39f9a2f35457077d315b0eac96e2057d4af0
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f
bzip2-libs-1.0.3-6.el5_5.x86_64.rpm	SHA-256: e4f95d0eb43db6e489c53a0ff46684271741d9e5c9db4c3b185cb99ae2bfe01c
i386
bzip2-devel-1.0.3-6.el5_5.i386.rpm	SHA-256: 68f9676aee46a2248c24b311ba42f8fc5a0e9ed2a88466570fe6d850dca04227
bzip2-libs-1.0.3-6.el5_5.i386.rpm	SHA-256: f21461f57c5dd7f8fffbdd0c9dcb36b64f24e2c38fb1f61c3b0c788fb6852a7f