Knowledge Base

Summaries and Symptoms

The service console package for Gzip is updated to version gzip-1.3.3-15.rhel3. This update fixes an integer underflow error in the way Gzip expands archive files. The integer underflow error, which leads to an array index error, was found in the way Gzip expanded archive files compressed with the Lempel-Ziv-Welch (LZW) compression algorithm. Expanding the archive might cause Gzip to fail, or potentially, allow execution of arbitrary code with the privileges of the user running Gzip. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-0001 to this issue.

Deployment Considerations

None beyond the required patch bundles and reboot information listed in the table, above.

Patch Download and Installation

See the vCenter Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX 3.5 hosts.

To update ESX 3.5 hosts without using Update Manager, download the most recent patch bundle from http://www.vmware.com/download/vi/vi3_patches_35.html and install the bundle using esxupdate from the command line of the host. For more information, see the ESX Server 3 Patch Management Guide.