Boost zlib Remote Code Execution Vulnerability

[aelfisha]

trafficstars

It was announced that Boost C++ Libraries versions ≤ 1.77.0 have a "Remote Code Execution" vulnerability because of dependency on zlib. Is there any intention to update to the boost version >= 1.78.0?

An update to boost was done in 1.78.0 to mitigate the issue in zlib.

[gunnarx]

@aelfisha Can you provide a link to the particular CVE or other reference to what you are thinking about?

In this search I did not find which one might apply: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=boost

Also did not find anything immediately in the release notes: https://www.boost.org/users/history/version_1_78_0.html

It was announced

Where was it announced, please?

[aelfisha]

@gunnarx Can you please check the below link. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9840

[goncaloalmeida]

Fixed on version 3.3.0 (master branch).