Description
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gzip | 1.3.5-10 | — |
| Debian 13 | gzip | 1.3.5-10 | — |
| Debian 12 | gzip | 1.3.5-10 | — |
| Debian 3.0 | gzip | 1.3.2-3woody5 | DSA-752-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gzip | 1.3.3-15.rhel4 | RHSA-2005:357 |
| RHEL 3 | gzip | 1.3.3-12.rhel3 | RHSA-2005:357 |
Advisories 2
- RHSA-2005:357 Red Hat Security Advisory: gzip security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-752-1 gzip - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- APPLE-SA-2006-08-01 vendor-advisory
- 22033 third-party-advisory
- ADV-2006-3101 vdb-entry
- 21253 third-party-advisory
- DSA-752 vendor-advisory
- 101816 vendor-advisory
- RHSA-2005:357 vendor-advisory
- 19289 vdb-entry
- TA06-214A third-party-advisory
- 12996 vdb-entry
- 15487 vdb-entry
- oval:org.mitre.oval:def:765 vdb-entry signature
- oval:org.mitre.oval:def:10242 vdb-entry signature
- oval:org.mitre.oval:def:1169 vdb-entry signature
- 18100 third-party-advisory
- SSA:2006-262 vendor-advisory
- 20050404 gzip TOCTOU file-permissions vulnerability mailing-list