CVE-2009-1391

描述

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

如何修補 CVE-2009-1391

要修補 CVE-2009-1391,請將受影響套件升級到下列已修補版本。

• Debian/libcompress-raw-zlib-perl—升級至 2.015-2 或更新版本
• Debian/perl—升級至 5.10.0-23 或更新版本

CVE-2009-1391 正在被利用嗎?

中等 — EPSS 為 7.4%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, < 2.015-2
• from 0, < 5.10.0-23

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-1391