Bug 100686 – app-emulation/emul-linux-x86-baselibs-2.1.1 contains vulnerable version of zlib

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Torsten Kaiser 2005-07-29 03:44:57 UTC]

app-emulation/emul-linux-x86-baselibs-2.1.1 contains a 32bit version of zlib. 
The tarball contains the file emul/linux/x86/lib/libz.so.1.2.2 , which 
according to GLSA-200507-19 is affected by a buffer overflow and potentially 
execution of arbitrary code. 

Reproducible: Always
Steps to Reproduce:
1.emerge =app-emulation/emul-linux-x86-baselibs-2.1.1  
  
Actual Results:  
This installs /emul/linux/x86/lib/libz.so.1.2.2  

Expected Results:  
Installation of /emul/linux/x86/lib/libz.so.1.2.3 

This is a CRITICAL flaw!  
If you want to use flash on amd64, you need to use a 32bit browser. Which will  
use a 32bit zlib. Which is right now a vulnerable version.

[Comment 1 Thierry Carrez (RETIRED) 2005-07-29 06:00:47 UTC]

AMD64 team, I guess you need to push a new baselibs package to fix this...

[Comment 2 Simon Stelling (RETIRED) 2005-07-29 06:42:39 UTC]

i'll provide an updated version asap

[Comment 3 Simon Stelling (RETIRED) 2005-07-29 08:15:55 UTC]

emul-linux-x86-baselibs-2.2.tar.bz2 is in /space/distfiles-local on toucan, in
four hours i'll put the bumped ebuild into the tree

[Comment 4 Simon Stelling (RETIRED) 2005-07-29 12:19:22 UTC]

ebuild is in portage and marked stable on all arches (what a wonder)

[Comment 5 Willie Sippel 2005-07-30 10:18:43 UTC]

If I try to compile Wine now (manually, using gcc32/ no chroot), it fails when 
linking zlib - ld doesn't seem to recognize libz.so.1.2.3 ("ldconfig -v" lists 
it, the Flash plugin works - but ld fails)... After downgrading to 
baselibs-2.1.1, everything works again. 

[Comment 6 gpiez 2005-07-30 11:28:57 UTC]

Version 2.2 doesn't have libgmodule-1.2.so.0 anymore. This is needed for  
configuring turboprint (commercial 32 bit printer driver for canon etc):  
 
cruncher ~ # xtpsetup 
xtpsetup: error while loading shared libraries: libgmodule-1.2.so.0: cannot 
open shared object file: No such file or directory 
 
After downgrading again, xtpsetup works again. 
 

[Comment 7 Simon Stelling (RETIRED) 2005-07-30 11:35:45 UTC]

In reply to comment 5:
Please open another bug for this, but try 2.2.2 first (not yet in portage, but
will be commited in a few hours)

In reply to comment 6:
I'm aware of that, will be fixed with 2.2.2. You may want have a look at bug 100795

[Comment 8 Thierry Carrez (RETIRED) 2005-07-30 12:42:12 UTC]

GLSA 200507-28

[Comment 9 Sune Kloppenborg Jeppesen (RETIRED) 2005-08-02 02:06:54 UTC]

[10:43:43] <blubb> the problem is: since my emul-linux-x86-baselibs-2.2 had 
lots of problems, Herbs created 2.1.2, which also fixes the hole and removed 
the broken 2.2, but the GLSA still says <2.2 is vulnerable 
 
GLSA updated