The vulnerability is rooted in the free() function and how it used. Quoting from the EnGarde Secure Linux advisory, "The zlib shared library may attempt to free() a memory region more then once, potentially yielding a system exploitable by certain programs that use it for decompression. Because certain packages include their own zlib implementation or statically link against the system zlib, several packages need to be updated to properly fix this bug."

This vulnerability will also affect some vendors shipping implementations of the open source library within their binary applications.

Packages including X11, rsync, the Linux kernel, QT, mozilla, gcc, vnc, and many other programs that have the ability to use network compression are potentially vulnerable.

The reason this particular vulnerability is so significant is because many programs implement their own particular version of the zlib library, statically linked with their code, and therefore inheriting the potential for exploit.

No known exploit is available for this vulnerability at this time, but the implications of this vulnerability are significant, and have the potential for remote compromise leading to root privileges on the server.

As vendors post their advisories, LinuxSecurity will continue to update this page and our site, directing the Linux and open source security communities to the authoritative information from their Linux vendor.

Resources

• Common Vulnerabilities and Exposures entry for this vulnerability http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0059

• CERT: Double Free Bug in zlib Compression Library
  http://www.linuxsecurity.com/articles/security_sources_article-4589.html

• EnGarde Secure Linux Advisory
  http://www.linuxsecurity.com/advisories/other_advisory-1960.html

• Red Hat Powertools
  http://www.linuxsecurity.com/advisories/redhat_advisory-1965.html

• Red Hat Linux
  http://www.linuxsecurity.com/advisories/redhat_advisory-1963.html

• Many SuSE Products, Part I
  http://www.linuxsecurity.com/advisories/suse_advisory-1967.html

• Many SuSE Products, Part II
  http://www.linuxsecurity.com/advisories/suse_advisory-1966.html

• Debian
  http://www.linuxsecurity.com/advisories/debian_advisory-1968.html

• Slackware rsync
  http://www.linuxsecurity.com/advisories/slackware_advisory-1974.html

• Slackware cvs
  http://www.linuxsecurity.com/advisories/slackware_advisory-1975.html

• Slackware zlib
  http://www.linuxsecurity.com/advisories/slackware_advisory-1973.html

• Mandrake
  http://www.linuxsecurity.com/advisories/mandrake_advisory-1976.html
  Update: http://www.linuxsecurity.com/advisories/mandrake_advisory-1983.html

• Conectiva http://www.linuxsecurity.com/advisories/other_advisory-1982.html

Thanks to Ryan W. Maple for assistance with this report. This page will be updated continually, as vendors file their vulnerability reports.