Summary
USN-8733-1 fixed vulnerabilities in Gzip. This update provides the
corresponding fix for Gzip on Ubuntu 14.04 LTS, Ubuntu 18.04 LTS and Ubuntu
20.04 LTS.
Original advisory details:
Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe
utility created temporary files in an insecure manner when mktemp was
unavailable. A local attacker could possibly use this issue to overwrite
arbitrary files. (CVE-2026-41991)
Elias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that
Gzip incorrectly handled certain compressed files. An attacker could
possibly use this issue to obtain sensitive information or cause Gzip to
crash, resulting in a denial of service. (CVE-2026-41992)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | gzip | 1.6-3ubuntu1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gzip | 1.6-5ubuntu1.2+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gzip | 1.10-0ubuntu4.1+esm1 |
Vulnerabilities 2
-
Medium 6.9
Global Buffer Overflow in GNU gzip
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across …
-
Low 2.0
Predictable Temporary File in GNU gzip
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This …