Security vulnerabilities in the gzip(1) command may allow a local or remote unprivileged user to execute arbitrary code with the privileges of another user who runs the gzip(1) command, or cause a Denial of Service (DoS) condition using a specially crafted gzip archive.

These issues are also referenced in the following documents:

• CVE-2006-4334 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334
• CVE-2006-4335 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335
• CVE-2006-4336 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336
• CVE-2006-4337 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337
• CVE-2006-4338 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338
• VU#554780 at: http://www.kb.cert.org/vuls/id/554780
• VU#773548 at: http://www.kb.cert.org/vuls/id/773548
• VU#381508 at: http://www.kb.cert.org/vuls/id/381508
• VU#933712 at: http://www.kb.cert.org/vuls/id/933712
• VU#596848 at: http://www.kb.cert.org/vuls/id/596848

Sun acknowledges with thanks, Tavis Ormandy, Google Security Team, for discovering and reporting these issues.

These issues can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 112668-04
• Solaris 9 without patch 116340-06
• Solaris 10 without patch 120719-02

x86 Platform

• Solaris 8 without patch 112669-04
• Solaris 9 without patch 116341-06
• Solaris 10 without patch 120720-02

There are no predictable symptoms that would indicate the described issues have been exploited.

There is no workaround.  Please see the Resolution section below.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 112668-04 or later
• Solaris 9 with patch 116340-06 or later
• Solaris 10 with patch 120719-02 or later

x86 Platform

• Solaris 8 with patch 112669-04 or later
• Solaris 9 with patch 116341-06 or later
• Solaris 10 with patch 120720-02 or later

• Updated Contributing Factors and Resolution section

• Updated Relief/Workaround section

• Updated Relief/Workaround section

• State: Resolved
• Updated Contributing Factors, Relief/Workaround, and Resolution sections.

This solution has no attachment