------------------------------------------------------------------------
Pardus Linux Security Advisory 2010-86            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2010-06-24
  Severity: 3
      Type: Local
------------------------------------------------------------------------

Summary
======
An integer underflow vulnerability has been fixed which can be used  by
malicious people to cause denial of service.


Description
==========
Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on
64-bit platforms allows remote attackers to cause a denial  of  service
(application crash) or possibly execute arbitrary code via a crafted

archive that uses LZW compression, leading to  an  array  index  error.
Similar vulnerability with PLSA 2010-14


Affected packages:

  Pardus 2009:
    ncompress, all before 4.2.4.2-7-5


Resolution
=========
There are update(s) for ncompress. You  can  update  them  via  Package
Manager or with a single command from console:

    pisi up ncompress

References
=========
  * http://bugs.pardus.org.tr/show_bug.cgi?id494
  * http://security.pardus.org.tr/en/2010-14/

------------------------------------------------------------------------