Description
The read_buf function in stream.c in rzip 2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rzip | 2.1-4.1 | — |
| Debian 13 | rzip | 2.1-4.1 | — |
| Debian 12 | rzip | 2.1-4.1 | — |
| Debian 8 | rzip | 2.1-2+deb8u1 | DLA-2189-1 |
| Debian 7 | rzip | 2.1-1+deb7u1 | DLA-955-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | rzip | 2.1-2ubuntu0.14.04.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rzip | 2.1-149.11 | openSUSE-SU-2024:11362-1 |
Advisories 3
- DLA-955-1 rzip - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2189-1 rzip - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11362-1 rzip-2.1-149.11 on GA media SUSE / openSUSE Security Updates · May 7, 2025