Date: Mon, 11 Mar 2002 18:59:24 -0500 From: Alan Eldridge <alane@geeksrus.net> To: Brooks Davis <brooks@one-eyed-alien.net> Cc: FreeBSD Stable List <freebsd-stable@FreeBSD.ORG> Subject: Re: zlib security advisory Message-ID: <20020311235924.GA70842@wwweasel.geeksrus.net> In-Reply-To: <20020311155230.A24573@Odin.AC.HMC.Edu> References: <20020311233900.GC70667@wwweasel.geeksrus.net> <20020311155230.A24573@Odin.AC.HMC.Edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Mar 11, 2002 at 03:52:30PM -0800, Brooks Davis wrote: >On Mon, Mar 11, 2002 at 06:39:00PM -0500, Alan Eldridge wrote: >> Redhat just announced a security problem is zlib which affects, oh, >> half the bloody world of network programs. A CERT advisory is expected >> to follow. Do we have a patch, or should I work one up based on >> RedHat's? >> >> http://www.linuxsecurity.com/advisories/redhat_advisory-1963.html > >The updated zlib has been commited to current stable will presumably >follow shortly. Additionaly, phk says that the FreeBSD malloc should >not be vulnerable to exploits of this type. It will produce a warning >and either continue or exit depending on your malloc flags. FWIW RH notes several things that either have their own copy of zlib that needs to be patched or that statically link and so need to be rebuilt. Has anyone produced such a list for FBSD, or is it not applicable to us? I suppose, to be safe, an inventory of ports needs to be done, too. Urk. -- Alan Eldridge "Dave's not here, man." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020311235924.GA70842>