p PatchFirst

CVE-2022-1271

CVE-2022-1271

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

CVSS 8.8 · High · EPSS 5.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gzip, xz-utils

    Versions
    • Fixed in gzip 1.12: Affected

    No fix published

  • gzip Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.12-1

    Update to 1.12-1

  • gzip Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.12-1

    Update to 1.12-1

  • gzip Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.12-1

    Update to 1.12-1

  • xz-utils Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.2.5-2.1

    Update to 5.2.5-2.1

  • xz-utils Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.2.5-2.1

    Update to 5.2.5-2.1

  • xz-utils Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.2.5-2.1

    Update to 5.2.5-2.1

  • gzip Ubuntu:Pro:14.04:LTS

    Versions
    • 1.6-2ubuntu1
    • 1.6-3ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.6-3ubuntu1+esm1

    Update to 1.6-3ubuntu1+esm1

  • xz-utils Ubuntu:Pro:14.04:LTS

    Versions
    • 5.1.1alpha+20120614-2ubuntu1
    • 5.1.1alpha+20120614-2ubuntu2
    Affected ranges
    • ECOSYSTEM: < 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1

    Update to 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1

  • gzip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.6-4ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.6-4ubuntu1+esm1

    Update to 1.6-4ubuntu1+esm1

  • xz-utils Ubuntu:Pro:16.04:LTS

    Versions
    • 5.1.1alpha+20120614-2ubuntu2
    Affected ranges
    • ECOSYSTEM: < 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1

    Update to 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1

  • gzip Ubuntu:18.04:LTS

    Versions
    • 1.6-5ubuntu1
    • 1.6-5ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.6-5ubuntu1.2

    Update to 1.6-5ubuntu1.2

  • xz-utils Ubuntu:18.04:LTS

    Versions
    • 5.2.2-1.3
    Affected ranges
    • ECOSYSTEM: < 5.2.2-1.3ubuntu0.1

    Update to 5.2.2-1.3ubuntu0.1

  • gzip Ubuntu:20.04:LTS

    Versions
    • 1.10-0ubuntu3
    • 1.10-0ubuntu4
    Affected ranges
    • ECOSYSTEM: < 1.10-0ubuntu4.1

    Update to 1.10-0ubuntu4.1

  • xz-utils Ubuntu:20.04:LTS

    Versions
    • 5.2.4-1
    • 5.2.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5.2.4-1ubuntu1.1

    Update to 5.2.4-1ubuntu1.1

  • gzip Ubuntu:22.04:LTS

    Versions
    • 1.10-4ubuntu1
    • 1.10-4ubuntu2
    • 1.10-4ubuntu3
    Affected ranges
    • ECOSYSTEM: < 1.10-4ubuntu4

    Update to 1.10-4ubuntu4

  • xz-utils Ubuntu:22.04:LTS

    Versions
    • 5.2.5-2
    • 5.2.5-2build1
    • 5.2.5-2build2
    Affected ranges
    • ECOSYSTEM: < 5.2.5-2ubuntu1

    Update to 5.2.5-2ubuntu1

Original sources

Check your server →