IBM Corporation Information for VU#142121

zlib "gzprintf()" function vulnerable to buffer overflow

Status

Affected

Vendor Statement

The AIX operating system is not vulnerable to the issues discussed in Vulnerability Note VU#142121.

However, zlib is available for installation on AIX via the AIX Toolbox for Linux. These items are shipped "as is" and are unwarranted.

A patched version of the zlib library can be downloaded from:

ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/zlib/zlib-1.1.4-3.aix4.3.ppc.rpm

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.