CVE-2004-1349

gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files...

PT-2004-2266 · Gnu +1 · Gzip +1

Name of the Vulnerable Software and Affected Versions: gzip version 1.3 and earlier in Solaris 8 Description: The issue allows local users to view or modify files that are hard linked to the target files when gzip is called with the -f or -force flags. Recommendations: For gzip version 1.3 and...

Debian DSA-100-1 : gzip - Potential buffer overflow

GOBBLES found a buffer overflow in gzip that occurs when compressing files with really long filenames. Even though GOBBLES claims to have developed an exploit to take advantage of this bug, it has been said by others that this problem is not likely to be exploitable as other security incidents...

Debian DSA-308-1 : gzip - insecure temporary files

Paul Szabo discovered that znew, a script included in the gzip package, creates its temporary files without taking precautions to avoid a symlink attack CAN-2003-0367. The gzexe script has a similar vulnerability which was patched in an earlier release but inadvertently reverted. %NASLMINLEVEL...

CVE-2002-1245

Maped in LuxMan 0.41 uses the user-provided search path to find and execute the gzip program, which allows local users to modify /dev/mem and gain privileges via a modified PATH environment variable that points to a Trojan horse gzip program...

GLSA-200406-18 : gzip: Insecure creation of temporary files

The remote host is affected by the vulnerability described in GLSA-200406-18 gzip: Insecure creation of temporary files The script gzexe included with gzip contains a bug in the code that handles tempfile creation. If the creation of a temp file fails when using gzexe fails instead of bailing out...

Mandrake Linux Security Advisory : gzip (MDKSA-2002:011)

There are two problems with the gzip archiving program; the first is a crash when an input file name is over 1020 characters, and the second is a buffer overflow that could be exploited if gzip is run on a server such as an FTP server. The patch applied is from the gzip developers and the problem...

Mandrake Linux Security Advisory : gzip (MDKSA-2003:068)

A vulnerability exists in znew, a script included with gzip, that would create temporary files without taking precautions to avoid a symlink attack. Patches have been applied to make use of mktemp to generate unique filenames, and properly make use of noclobber in the script. Likewise, a fix for...

Solaris 9 (sparc) : 116340-09

SunOS 5.9: gzip and Freeware info files patch. Date this patch was last updated by Sun : May/05/10 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 8 (sparc) : 112668-04

SunOS 5.8: gzip patch. Date this patch was last updated by Sun : Mar/06/07 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid1339...

Solaris 8 (x86) : 112669-04

SunOS 5.8x86: gzip patch. Date this patch was last updated by Sun : Mar/06/07 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2004-0603

gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary commands, a different vulnerability than CVE-1999-1332...

CVE-2004-0603

CVE-2004-0603 relates to gzip (gzexe) in versions 1.3.3 and earlier. The vulnerability arises when temporary file creation fails: gzexe will continue execution instead of exiting, potentially allowing remote attackers or local users to run arbitrary commands. The issue is documented in various ad...

[ GLSA 200406-18 ] gzip: Insecure creation of temporary files

Gentoo Linux Security Advisory GLSA 200406-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

gzip: Insecure creation of temporary files

Background gzip GNU zip is popular compression program. The included gzexe utility allows you to compress executables in place and have them automatically uncompress and execute when you run them. Description The script gzexe included with gzip contains a bug in the code that handles tempfile...

DEBIAN-CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

CVE-2002-1569

gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for 1 a PDF file or 2 a gzip file...

CVE-2003-0842

Stack-based buffer overflow in modgzipprintf for modgzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an "Accept-Encoding: gzip" header...