[SECURITY] [DSA 5122-1] gzip security update

2022-04-1819:31:16

lists.debian.org

gzip

security update

filename vulnerability

debian

cve-2022-1271

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.012

Percentile

85.7%

JSON

Debian Security Advisory DSA-5122-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
April 18, 2022 https://www.debian.org/security/faq

Package : gzip
CVE ID : CVE-2022-1271
Debian Bug : 1009168

cleemy desu wayo reported that incorrect handling of filenames by zgrep
in gzip, the GNU compression utilities, can result in overwrite of
arbitrary files or execution of arbitrary code if a file with a
specially crafted filename is processed.

For the oldstable distribution (buster), this problem has been fixed
in version 1.9-3+deb10u1.

For the stable distribution (bullseye), this problem has been fixed in
version 1.10-4+deb11u1.

We recommend that you upgrade your gzip packages.

For the detailed security status of gzip please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/gzip

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10armhfliblzma5< 5.2.4-1+deb10u1liblzma5_5.2.4-1+deb10u1_armhf.deb
Debian11ppc64elxzdec-dbgsym< 5.2.5-2.1~deb11u1xzdec-dbgsym_5.2.5-2.1~deb11u1_ppc64el.deb
Debian11allliblzma-doc< 5.2.5-2.1~deb11u1liblzma-doc_5.2.5-2.1~deb11u1_all.deb
Debian11i386xz-utils-dbgsym< 5.2.5-2.1~deb11u1xz-utils-dbgsym_5.2.5-2.1~deb11u1_i386.deb
Debian9amd64xzdec< 5.2.2-1.2+deb9u1xzdec_5.2.2-1.2+deb9u1_amd64.deb
Debian9armelxz-utils< 5.2.2-1.2+deb9u1xz-utils_5.2.2-1.2+deb9u1_armel.deb
Debian11amd64gzip-dbgsym< 1.10-4+deb11u1gzip-dbgsym_1.10-4+deb11u1_amd64.deb
Debian11s390xxzdec< 5.2.5-2.1~deb11u1xzdec_5.2.5-2.1~deb11u1_s390x.deb
Debian9allgzip-win32< 1.6-5+deb9u1gzip-win32_1.6-5+deb9u1_all.deb
Debian10arm64xz-utils< 5.2.4-1+deb10u1xz-utils_5.2.4-1+deb10u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armhf	liblzma5	< 5.2.4-1+deb10u1	liblzma5_5.2.4-1+deb10u1_armhf.deb
Debian	11	ppc64el	xzdec-dbgsym	< 5.2.5-2.1~deb11u1	xzdec-dbgsym_5.2.5-2.1~deb11u1_ppc64el.deb
Debian	11	all	liblzma-doc	< 5.2.5-2.1~deb11u1	liblzma-doc_5.2.5-2.1~deb11u1_all.deb
Debian	11	i386	xz-utils-dbgsym	< 5.2.5-2.1~deb11u1	xz-utils-dbgsym_5.2.5-2.1~deb11u1_i386.deb
Debian	9	amd64	xzdec	< 5.2.2-1.2+deb9u1	xzdec_5.2.2-1.2+deb9u1_amd64.deb
Debian	9	armel	xz-utils	< 5.2.2-1.2+deb9u1	xz-utils_5.2.2-1.2+deb9u1_armel.deb
Debian	11	amd64	gzip-dbgsym	< 1.10-4+deb11u1	gzip-dbgsym_1.10-4+deb11u1_amd64.deb
Debian	11	s390x	xzdec	< 5.2.5-2.1~deb11u1	xzdec_5.2.5-2.1~deb11u1_s390x.deb
Debian	9	all	gzip-win32	< 1.6-5+deb9u1	gzip-win32_1.6-5+deb9u1_all.deb
Debian	10	arm64	xz-utils	< 5.2.4-1+deb10u1	xz-utils_5.2.4-1+deb10u1_arm64.deb