[SECURITY] [DSA 5122-1] gzip security update

2022-04-1819:31:16

lists.debian.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.3%

JSON

Debian Security Advisory DSA-5122-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
April 18, 2022 https://www.debian.org/security/faq

Package : gzip
CVE ID : CVE-2022-1271
Debian Bug : 1009168

cleemy desu wayo reported that incorrect handling of filenames by zgrep
in gzip, the GNU compression utilities, can result in overwrite of
arbitrary files or execution of arbitrary code if a file with a
specially crafted filename is processed.

For the oldstable distribution (buster), this problem has been fixed
in version 1.9-3+deb10u1.

For the stable distribution (bullseye), this problem has been fixed in
version 1.10-4+deb11u1.

We recommend that you upgrade your gzip packages.

For the detailed security status of gzip please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/gzip

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11mips64elxz-utils-dbgsym< 5.2.5-2.1~deb11u1xz-utils-dbgsym_5.2.5-2.1~deb11u1_mips64el.deb
Debian9armelliblzma5< 5.2.2-1.2+deb9u1liblzma5_5.2.2-1.2+deb9u1_armel.deb
Debian11i386gzip-dbgsym< 1.10-4+deb11u1gzip-dbgsym_1.10-4+deb11u1_i386.deb
Debian10mipselxzdec< 5.2.4-1+deb10u1xzdec_5.2.4-1+deb10u1_mipsel.deb
Debian11ppc64elxzdec-dbgsym< 5.2.5-2.1~deb11u1xzdec-dbgsym_5.2.5-2.1~deb11u1_ppc64el.deb
Debian9i386xz-utils< 5.2.2-1.2+deb9u1xz-utils_5.2.2-1.2+deb9u1_i386.deb
Debian9armelxzdec< 5.2.2-1.2+deb9u1xzdec_5.2.2-1.2+deb9u1_armel.deb
Debian11amd64gzip-dbgsym< 1.10-4+deb11u1gzip-dbgsym_1.10-4+deb11u1_amd64.deb
Debian9arm64xz-utils< 5.2.2-1.2+deb9u1xz-utils_5.2.2-1.2+deb9u1_arm64.deb
Debian10s390xliblzma5< 5.2.4-1+deb10u1liblzma5_5.2.4-1+deb10u1_s390x.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mips64el	xz-utils-dbgsym	< 5.2.5-2.1~deb11u1	xz-utils-dbgsym_5.2.5-2.1~deb11u1_mips64el.deb
Debian	9	armel	liblzma5	< 5.2.2-1.2+deb9u1	liblzma5_5.2.2-1.2+deb9u1_armel.deb
Debian	11	i386	gzip-dbgsym	< 1.10-4+deb11u1	gzip-dbgsym_1.10-4+deb11u1_i386.deb
Debian	10	mipsel	xzdec	< 5.2.4-1+deb10u1	xzdec_5.2.4-1+deb10u1_mipsel.deb
Debian	11	ppc64el	xzdec-dbgsym	< 5.2.5-2.1~deb11u1	xzdec-dbgsym_5.2.5-2.1~deb11u1_ppc64el.deb
Debian	9	i386	xz-utils	< 5.2.2-1.2+deb9u1	xz-utils_5.2.2-1.2+deb9u1_i386.deb
Debian	9	armel	xzdec	< 5.2.2-1.2+deb9u1	xzdec_5.2.2-1.2+deb9u1_armel.deb
Debian	11	amd64	gzip-dbgsym	< 1.10-4+deb11u1	gzip-dbgsym_1.10-4+deb11u1_amd64.deb
Debian	9	arm64	xz-utils	< 5.2.2-1.2+deb9u1	xz-utils_5.2.2-1.2+deb9u1_arm64.deb
Debian	10	s390x	liblzma5	< 5.2.4-1+deb10u1	liblzma5_5.2.4-1+deb10u1_s390x.deb