Description
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bzip2 | 1.0.2-8.1 | — |
| Debian 14 | gzip | 1.3.5-10 | — |
| Debian 13 | bzip2 | 1.0.2-8.1 | — |
| Debian 13 | gzip | 1.3.5-10 | — |
| Debian 12 | bzip2 | 1.0.2-8.1 | — |
| Debian 12 | gzip | 1.3.5-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | bzip2 +2 | 1.0.2-13.EL4.3 | RHSA-2005:474 |
| RHEL 4 | gzip | 1.3.3-15.rhel4 | RHSA-2005:357 |
| RHEL 3 | bzip2 +2 | 1.0.2-11.EL3.4 | RHSA-2005:474 |
| RHEL 3 | gzip | 1.3.3-12.rhel3 | RHSA-2005:357 |
Advisories 2
- RHSA-2005:474 Red Hat Security Advisory: bzip2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:357 Red Hat Security Advisory: gzip security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- USN-158-1 vendor-advisory
- 16371 vdb-entry
- FLSA:158801 vendor-advisory
- ADV-2007-2732 vdb-entry
- MDKSA-2006:027 vendor-advisory
- 22033 third-party-advisory
- RHSA-2005:357 vendor-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- OpenPKG-SA-2007.002 vendor-advisory
- oval:org.mitre.oval:def:9797 vdb-entry signature
- oval:org.mitre.oval:def:1107 vdb-entry signature
- gzip-zgrep-file-installation(20539) vdb-entry
- http://docs.info.apple.com/article.html?artnum=306172
- GLSA-200505-05 vendor-advisory
- 25159 vdb-entry
- oval:org.mitre.oval:def:1081 vdb-entry signature
- 13582 vdb-entry
- 18100 third-party-advisory
- SSA:2006-262 vendor-advisory
- 19183 third-party-advisory
- 1013928 vdb-entry
- MDKSA-2006:026 vendor-advisory
- RHSA-2005:474 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=90626
- 26235 third-party-advisory