An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example a crafted file name) this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote low privileged attacker to force zgrep to write arbitrary files on the system.

🗓️ 08 Sep 2022 07:00:00Reported by MicrosoftType

GNU gzip zgrep allows arbitrary file writes via crafted multi-line filenames.

Reporter	Title	Published	Views	Family All 360
ALT Linux	Security fix for the ALT Linux 9 package gzip version 1.10-alt1.p9.1	10 Apr 202300:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package gzip version 1.12-alt1	11 Apr 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	25 Aug 202202:03	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	22 Nov 202206:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	9 Nov 202218:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip (CVE-2022-1271)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in base image packages	7 Oct 202220:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Cloud Pak for Watson AIOPs	3 Oct 202218:44	–	ibm