USN-8733-1: Gzip vulnerabilities
Ubuntu issued USN-8733-1 fixing two Gzip flaws: insecure gzexe temp files allowing file overwrites, and a crafted-file DoS/info exposure bug.
USN-8733-1 updates Gzip in Ubuntu to fix CVE-2026-41991, where the gzexe utility created temporary files insecurely when mktemp was unavailable, letting a local attacker overwrite arbitrary files. It also fixes CVE-2026-41992, incorrect handling of certain compressed files that could expose sensitive information or crash Gzip in a denial of service. Both issues have local impact and are addressed via updated Ubuntu packages.
- CVE-2026-41991: insecure temporary file handling in gzexe allows local arbitrary file overwrite
- CVE-2026-41992: crafted compressed files can cause information exposure or denial of service
- Both flaws are local-impact; users should install updated Gzip packages
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-41992+1 related CVE | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different… | 6.9 group max | <1% |
From the original article
Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. (CVE-2026-41991) Elias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip incorrectly handled certain compressed files.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.