124 matches found
Debian DLA-2976-1 : gzip - LTS security update
The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2976 advisory. - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, th...
Debian DLA-2977-1 : xz-utils - LTS security update
The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2977 advisory. An arbitrary-file-write vulnerability was discovered in xz-utils, which provides XZ-format compression utilities. For Debian 9 stretch, this problem has been fixed in versi...
CVE-2022-1271
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...
GNU Gzip 输入验证错误漏洞
GNU Gzip is a compression/decompression program from the GNU community. An input validation error vulnerability exists in GNU Gzip due to insufficient validation when handling filenames with two or more newlines. A remote attacker could force zgrep or xzgrep to write arbitrary files on the system...
PT-2022-2156 · Gnu +11 · Gnu Gzip +11
Name of the Vulnerable Software and Affected Versions: GNU gzip versions affected versions not specified Description: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. This flaw occurs due to insufficient validation when processing filenames with two or more newlines...
CVE-2022-1271
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...
UBUNTU-CVE-2022-1271
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
MyLog4Shell log4j RCE Exploitation Detection You can use th...
One Weird Trick for Reviewing Zeek Logs on the Command Line!
Are you a network security monitoring dinosaur like me? Do you prefer to inspect your Zeek logs using the command line instead of a Web-based SIEM? If yes, try this one weird trick! I store my Zeek logs in JSON format. Sometimes I like to view the output using jq. If I need to search directories ...
bzip2 bzgrep and gzip zgrep shell characters problem
Unfiltered characters in filename allow code execution...
[ MDKSA-2006:027 ] - Updated gzip packages fix zgrep vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2006:027 http://www.mandriva.com/security/ Package : gzip Date : January 30, 2006 Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0, Multi Network Firewall 2.0 Problem Description: Zgrep in gzip before...
Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1)
zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names. Note that Tenable Network Security ha...
Ubuntu 4.10 / 5.04 : bzip2 vulnerability (USN-161-1)
USN-158-1 fixed a command injection vulnerability in the 'zgrep' utility. It was determined that the 'bzgrep' counterpart in the bzip2 package is vulnerable to the same flaw. bzgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be...
USN-158-1: gzip utility vulnerability
zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names...
security flaw
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...
gzip security update
CentOS Errata and Security Advisory CESA-2005:357 An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes...
security flaw
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...
CVE-2005-0758
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...
CVE-2005-0758
The CVE-2005-0758 issue affects gzip prior to 1.3.5, where zgrep does not properly sanitize file arguments, allowing local users to inject filenames into a sed script and execute arbitrary commands. Connected advisories confirm related issues (CVE-2005-0988 and CVE-2005-1228) in gunzip/bzip2 work...