1834 matches found
Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1)
zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names. Note that Tenable Network Security ha...
CVE-2005-3759
Multiple cross-site scripting XSS vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 gzip/tar and 2 css MIME viewers, which do not filter or escape dangerous HTML when extracting and displaying attachments...
Solaris 10 (sparc) : 120719-07 (deprecated)
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Gzip. Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update,...
Solaris 10 (x86) : 120720-07 (deprecated)
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Gzip. Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized update,...
USN-158-1: gzip utility vulnerability
zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names...
SOL4532 - gzip vulnerabilities CAN-2005-0758, CAN-2005-0988, and CAN-2005-1228
The vulnerabilities described in this article have been resolved, or do not affect any F5 products. There will be no further updates, unless new information is discovered...
FreeBSD : gzip -- directory traversal and permission race vulnerabilities (63bd4bad-dffe-11d9-b875-0001020eed82)
Problem Description Two problems related to extraction of files exist in gzip : The first problem is that gzip does not properly sanitize filenames containing '/' when uncompressing files using the -N command line option. The second problem is that gzip does not set permissions on newly extracted...
Debian DSA-752-1 : gzip - several vulnerabilities
Two problems have been discovered in gzip, the GNU compression utility. The Common Vulnerabilities and Exposures project identifies the following problems. - CAN-2005-0988 Imran Ghory discovered a race condition in the permissions setting code in gzip. When decompressing a file in a directory an...
[SECURITY] [DSA 752-1] New gzip packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 752-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...
[SECURITY] [DSA 752-1] New gzip packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 752-1 [email protected] http://www.debian.org/security/ Martin Schulze July 11th, 2005 http://www.debian.org/security/faq -...
security flaw
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...
gzip security update
CentOS Errata and Security Advisory CESA-2005:357-01 An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processe...
gzip security update
CentOS Errata and Security Advisory CESA-2005:357 An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes...
security flaw
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete...
security flaw
Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. dot dot in the original filename within a compressed file...
security flaw
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...
Low: Red Hat Security Advisory: gzip security update
An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes file names. If a user can be tricked into running...
RHEL 4 : gzip (RHSA-2005:357)
The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:357 advisory. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes file names. If a user can be...
FreeBSD-SA-05:11.gzip
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:11.gzip Security Advisory The FreeBSD Project Topic: gzip directory traversal and permission race vulnerabilities Category: contrib Module: gzip Announced:...
Security fix for the ALT Linux 5 package gzip version 1.3.5-alt1
May 19, 2005 Dmitry V. Levin 1.3.5-alt1 - Updated to 1.3.5. - Reviewed and reworked patches. - Added zegrep1 and zfgrep1 manpage links. - Changed zgrep and zdiff to handle also functionality of bzgrep, bzcmp and bzdiff utilities. - Changed znew utility to avoid dependence on compress utility. -...