1st security warning: "installed zlib version maycontainasecurity bug"

[Ted Mittelstaedt]

> -----Original Message-----
> From: owner-freebsd-questions at freebsd.org
> [mailto:owner-freebsd-questions at freebsd.org]On Behalf Of Mark
> Sent: Sunday, January 30, 2005 8:28 PM
> To: 'FreeBSD-Questions Questions'
> Subject: RE: 1st security warning: "installed zlib version
> maycontainasecurity bug"
> 
> 
> > -----Original Message-----
> > From: owner-freebsd-questions at freebsd.org 
> > [mailto:owner-freebsd-questions at freebsd.org] On Behalf Of Ted 
> > Mittelstaedt
> > Sent: maandag 31 januari 2005 1:40
> > To: Lowell Gilbert; Timothy Luoma
> > Cc: FreeBSD-Questions Questions
> > Subject: RE: 1st security warning: "installed zlib version 
> > may containasecurity bug"
> > 
> > zlib is part of the base OS it should be at version 1.2.2 in
> > FreeBSD 4.11R, since version 1.2.2 was released in October
> > 2004.
> 
> Ok, now you got me worried. How do I check my current version?

man zlib

> I am on FreeBSD 4.10R, with the all the latest security patches.
> Or so I thought.
> 
> > Keep in mind that this WILL NOT fix the zlib security hole in
> > the system. zlib is probably linked into a number of utilities
> > on your system and a proper fix would be to replace the zlib
> > library, and recompile all the utilities in the system that
> > are linked into the static library.
> 
> If there is a security hole, how come there is no advisory on the
> FreeBSD site? Or is there a place I did not look?
> 

there isn't one, because the CERT advisory only listed 1.2.x

you didn't read my second e-mail, obviously.

Ted