Gzip (Product): news timeline & CVEs

USN-8733-2: Gzip vulnerabilities

Ubuntu patches Gzip vulnerabilities (CVE-2026-41991) in USN-8733-2 for LTS versions, addressing insecure temp files and incorrect handling of compressed files.

Ubuntu has issued a security notice, USN-8733-2, to address vulnerabilities in the Gzip package for Ubuntu 14.04, 18.04, and 20.04 LTS versions. The update includes fixes for an insecure temporary file creation vulnerability (CVE-2026-41991) that could allow local attackers to overwrite arbitrary files, and other issues that could lead to information disclosure or denial of service. This advisory provides the corresponding fix for the original USN-8733-1 notice.

Ubuntu Security NoticesSep 22, 16:04 UTC · 4d agoAdvisory CVE-2026-41991

Can gzip be a language model?

A developer shows gzip can continue text by beam-searching byte sequences that compress best against a primed corpus.

A developer demonstrates language modeling with gzip by scoring candidate byte continuations using DEFLATE compressed length. A corpus is placed in zlib's 32 KiB window, and beam search keeps the spans that compress best before committing them. Single-byte greedy selection fails because compressed length is an integer and often unchanged. Text primed on tiny Shakespeare is only partly coherent, and the author notes earlier compression-only generation performed poorly without beam search.

Hacker News · AISep 22, 06:08 UTC · 5d agoAI research HN 55↑ · 10 comments1

USN-8733-1: Gzip vulnerabilities

Ubuntu issued USN-8733-1 fixing two Gzip flaws: insecure gzexe temp files allowing file overwrites, and a crafted-file DoS/info exposure bug.

USN-8733-1 updates Gzip in Ubuntu to fix CVE-2026-41991, where the gzexe utility created temporary files insecurely when mktemp was unavailable, letting a local attacker overwrite arbitrary files. It also fixes CVE-2026-41992, incorrect handling of certain compressed files that could expose sensitive information or crash Gzip in a denial of service. Both issues have local impact and are addressed via updated Ubuntu packages.

Ubuntu Security NoticesSep 7, 12:23 UTC · 19d agoAdvisory CVE-2026-41991 CVE-2026-41992

Gzip

Timeline3 articles

Related CVEsby mentions

Appears with

USN-8733-2: Gzip vulnerabilities

Can gzip be a language model?

USN-8733-1: Gzip vulnerabilities