CVE-2005-0758
Fixed in a distro release EPSS <1%
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
Products: gnu gzip, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | bzip2 | 1.0.2-8.1 |
| Debian 12 | gzip | 1.3.5-10 |
| Debian 13 | bzip2 | 1.0.2-8.1 |
| Debian 13 | gzip | 1.3.5-10 |
| Debian 14 | bzip2 | 1.0.2-8.1 |
| Debian 14 | gzip | 1.3.5-10 |
| Red Hat Enterprise Linux 3 | bzip2 | 0:1.0.2-11.EL3.4 |
| Red Hat Enterprise Linux 3 | bzip2-debuginfo | 0:1.0.2-11.EL3.4 |
| Red Hat Enterprise Linux 3 | bzip2-devel | 0:1.0.2-11.EL3.4 |
| Red Hat Enterprise Linux 3 | bzip2-libs | 0:1.0.2-11.EL3.4 |
| Red Hat Enterprise Linux 3 | gzip | 0:1.3.3-12.rhel3 |
| Red Hat Enterprise Linux 3 | gzip-debuginfo | 0:1.3.3-12.rhel3 |
| Red Hat Enterprise Linux 4 | bzip2 | 0:1.0.2-13.EL4.3 |
| Red Hat Enterprise Linux 4 | bzip2-debuginfo | 0:1.0.2-13.EL4.3 |
| Red Hat Enterprise Linux 4 | bzip2-devel | 0:1.0.2-13.EL4.3 |
| Red Hat Enterprise Linux 4 | bzip2-libs | 0:1.0.2-13.EL4.3 |
| Red Hat Enterprise Linux 4 | gzip | 0:1.3.3-15.rhel4 |
| Red Hat Enterprise Linux 4 | gzip-debuginfo | 0:1.3.3-15.rhel4 |